CVE-2021-29965: Medium severity Mozilla Firefox vulnerability
A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords for the currently active website instead of the website that triggered the dialog. This bug only affects Firefox for Android. Other operating systems are unaffected.
Other sources
A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords for the currently active website instead of the website that triggered the dialog. This bug only affects Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox < 89.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 89 - Upgrade
Upgrade
alpine/firefoxto a version that resolves this vulnerability.Fixed in 89.0-r0 - Upgrade
Upgrade
alpine/librewolfto a version that resolves this vulnerability.Fixed in 89.0-r0
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-29965.
Which web browser is affected by this vulnerability?
This vulnerability affects Firefox for Android.
What is the impact of this vulnerability?
A malicious website can trick the built-in password manager in Firefox for Android to suggest passwords for the wrong website.
How can I fix this vulnerability?
Update Firefox for Android to version 89 or higher.
Where can I find more information about this vulnerability?
You can find more information about this vulnerability at the following links: [Mozilla Bugzilla](https://bugzilla.mozilla.org/show_bug.cgi?id=1709257) and [Mozilla Security Advisories](https://www.mozilla.org/en-US/security/advisories/mfsa2021-23/).