CVE-2020-26951: XSS
A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal pages could have used this attack to bypass our built-in sanitizer.
Other sources
A parsing and event loading mismatch in Thunderbird's SVG code could have allowed load events to fire, even after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal pages could have used this attack to bypass our built-in sanitizer.
— Mozilla
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2020-26951?
CVE-2020-26951 is a vulnerability in Thunderbird's SVG code that could allow load events to fire, even after sanitization.
What software is affected by CVE-2020-26951?
CVE-2020-26951 affects Mozilla Firefox ESR versions up to 78.5, Mozilla Thunderbird version up to 78.5, and Mozilla Firefox versions up to 83.
How severe is CVE-2020-26951?
CVE-2020-26951 has a severity rating of 7 (high).
How can an attacker exploit CVE-2020-26951?
An attacker who can exploit an XSS vulnerability in privileged internal pages can use CVE-2020-26951 to bypass the built-in sanitizer.
What is the CWE classification of CVE-2020-26951?
CVE-2020-26951 is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation).