CVE-2020-15654: Medium severity Mozilla Firefox vulnerability
Last updated 25 August 2025
Other sources
When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not. This could lead to a perceived broken state, especially when interactions with existing browser dialogs and warnings do not work.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 78.1 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 79 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 78.1 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 148.0.2-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.12.0-1~deb11u1Fixed in 1:140.8.0esr-1~deb11u1Fixed in 1:140.6.0esr-1~deb12u1Fixed in 1:140.8.0esr-1~deb12u1Fixed in 1:140.6.0esr-1~deb13u1Fixed in 1:140.8.0esr-1~deb13u1Fixed in 1:140.8.0esr-1 - Upgrade
Upgrade
alpine/firefoxto a version that resolves this vulnerability.Fixed in 79.0-r0 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 78.1.0-r0 - Upgrade
Upgrade
alpine/librewolfto a version that resolves this vulnerability.Fixed in 79.0-r0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2020-15654?
CVE-2020-15654 is a vulnerability in Mozilla Firefox and Thunderbird that allows a website to make it look like the user is interacting with the user interface when they are not.
How does CVE-2020-15654 work?
CVE-2020-15654 works by specifying a custom cursor using CSS and putting the website in an endless loop, creating a perceived broken state.
What is the severity of CVE-2020-15654?
CVE-2020-15654 has a severity level of low.
Which software versions are affected by CVE-2020-15654?
Mozilla Firefox ESR 78.1, Mozilla Firefox up to version 79, and Mozilla Thunderbird 78.1 are affected by CVE-2020-15654.
How can I resolve CVE-2020-15654?
To resolve CVE-2020-15654, update your Mozilla Firefox or Thunderbird to the latest version provided by Mozilla.