CVE-2021-23976: High severity Mozilla Firefox vulnerability
When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. Note: This issue is a different issue from CVE-2020-26954 and only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 86.
Other sources
When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites.Note: This issue is a different issue from CVE-2020-26954 and only affected Firefox for Android. Other operating systems are unaffected.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 86 - Upgrade
Upgrade
alpine/firefoxto a version that resolves this vulnerability.Fixed in 87.0-r0 - Upgrade
Upgrade
alpine/librewolfto a version that resolves this vulnerability.Fixed in 87.0-r0 - Upgrade
Upgrade
Firefox for Androidto a version that resolves this vulnerability.Fixed in 86
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2021-23976?
CVE-2021-23976 is a vulnerability that allowed Firefox for Android to accept manifests from arbitrary file paths and declare webapp manifests for other origins, potentially enabling UI spoofing and cross-origin attacks.
What is the severity of CVE-2021-23976?
CVE-2021-23976 has a severity rating of medium.
Which software versions are affected by CVE-2021-23976?
Firefox for Android version 86 is affected by CVE-2021-23976.
How can CVE-2021-23976 be exploited?
CVE-2021-23976 can be exploited by malicious apps to gain fullscreen access for UI spoofing or launch cross-origin attacks.
Is there a fix available for CVE-2021-23976?
Yes, upgrading to version 86 of Firefox for Android addresses the vulnerability.