CVE-2020-26962: Medium severity firefox vulnerability
Cross-origin iframes that contained a login form could have been recognized by the login autofill service, and populated. This could have been used in clickjacking attacks, as well as be read across partitions in dynamic first party isolation.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2020-26962?
CVE-2020-26962 is a vulnerability in Firefox versions prior to 83 that allows cross-origin iframes containing a login form to be recognized by the login autofill service and populated, which can be exploited in clickjacking attacks and across partitions in dynamic first-party isolation.
How does CVE-2020-26962 affect Firefox?
CVE-2020-26962 affects Firefox versions prior to 83.
What is the severity of CVE-2020-26962?
The severity of CVE-2020-26962 is medium with a CVSS score of 6.1.
How can CVE-2020-26962 be exploited?
CVE-2020-26962 can be exploited in clickjacking attacks and can allow the reading of information across partitions in dynamic first-party isolation.
What is the remedy for CVE-2020-26962?
The remedy for CVE-2020-26962 is to update Firefox to version 83 or later.