CVE-2020-26979: Medium severity Mozilla Firefox vulnerability
When a user typed a URL in the address bar or the search bar and quickly hit the enter key, a website could sometimes capture that event and then redirect the user before navigation occurred to the desired, entered address. To construct a convincing spoof the attacker would have had to guess what the user was typing, perhaps by suggesting it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 84 - Upgrade
Upgrade
alpine/firefoxto a version that resolves this vulnerability.Fixed in 84.0.1-r0 - Upgrade
Upgrade
alpine/librewolfto a version that resolves this vulnerability.Fixed in 84.0.1-r0
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2020-26979?
CVE-2020-26979 has a medium severity rating due to the potential for spoofing attacks.
How do I fix CVE-2020-26979?
To mitigate CVE-2020-26979, update Mozilla Firefox to version 85 or later.
What versions of Firefox are affected by CVE-2020-26979?
CVE-2020-26979 affects Mozilla Firefox versions up to and including 84.
Can CVE-2020-26979 lead to phishing attacks?
Yes, CVE-2020-26979 could enable attackers to execute convincing phishing attacks through URL redirection.
Is there a workaround for CVE-2020-26979?
There are no specific workarounds for CVE-2020-26979 other than updating the browser to the latest version.