CVE-2021-24000: Race Condition
A race condition with requestPointerLock() and setTimeout() could have resulted in a user interacting with one tab when they believed they were on a separate tab. In conjunction with certain elements (such as <input type="file">) this could have led to an attack where a user was confused about the origin of the webpage and potentially disclosed information they did not intend to. This vulnerability affects Firefox < 88.
Other sources
A race condition with requestPointerLock() and setTimeout() could have resulted in a user interacting with one tab when they believed they were on a separate tab. In conjunction with certain elements (such as <input type="file">) this could have led to an attack where a user was confused about the origin of the webpage and potentially disclosed information they did not intend to.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 88 - Upgrade
Upgrade
alpine/firefoxto a version that resolves this vulnerability.Fixed in 88.0-r0 - Upgrade
Upgrade
alpine/librewolfto a version that resolves this vulnerability.Fixed in 88.0-r0
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2021-24000?
CVE-2021-24000 is a vulnerability that could have resulted in a user interacting with one tab when they believed they were on a separate tab in Mozilla Firefox.
How severe is CVE-2021-24000?
CVE-2021-24000 has a severity value of 3.1, which is considered medium.
How can CVE-2021-24000 be exploited?
CVE-2021-24000 could have been exploited through a race condition with requestPointerLock() and setTimeout() in conjunction with certain elements, such as <input type="file">.
Which software is affected by CVE-2021-24000?
Mozilla Firefox versions up to exclusive 88.0 are affected by CVE-2021-24000.
How can I mitigate CVE-2021-24000?
To mitigate CVE-2021-24000, users should update Mozilla Firefox to version 88.0 or later.