CVE-2021-43538: Race Condition

Reference Links

• https://bugzilla.mozilla.org/show_bug.cgi?id=1739091
• https://www.mozilla.org/en-US/security/advisories/mfsa2021-54/
• https://www.mozilla.org/en-US/security/advisories/mfsa2021-52/
• https://www.mozilla.org/en-US/security/advisories/mfsa2021-53/
• https://lists.debian.org/debian-lts-announce/2021/12/msg00030.html
• https://lists.debian.org/debian-lts-announce/2022/01/msg00001.html
• https://security.gentoo.org/glsa/202202-03
• https://security.gentoo.org/glsa/202208-14
• https://www.debian.org/security/2021/dsa-5026
• https://www.debian.org/security/2022/dsa-5034
• https://www.mozilla.org/security/advisories/mfsa2021-52/
• https://www.mozilla.org/security/advisories/mfsa2021-53/
• https://www.mozilla.org/security/advisories/mfsa2021-54/
• https://www.mozilla.org/en-US/security/advisories/mfsa2021-52/#CVE-2021-43538
• https://www.mozilla.org/en-US/security/advisories/mfsa2021-53/#CVE-2021-43538
• https://www.mozilla.org/en-US/security/advisories/mfsa2021-54/#CVE-2021-43538
• https://security-tracker.debian.org/tracker/CVE-2021-43538

Parent vulnerabilities

(Appears in the following advisories)

• MFSA2021-54
• MFSA2021-53
• MFSA2021-52

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2021-43536
• CVE-2021-43537
• CVE-2021-43538
• CVE-2021-43539
• CVE-2021-43541
• CVE-2021-43542
• CVE-2021-43543
• CVE-2021-43545
• CVE-2021-43546
• CVE-2021-43528
• CVE-2021-4129
• CVE-2021-4128
• CVE-2021-43540
• CVE-2021-43544

Frequently Asked Questions

• What is the vulnerability ID?

  The vulnerability ID is CVE-2021-43538.

• Which software is affected by this vulnerability?

  This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.

• How can an attacker exploit this vulnerability?

  By misusing a race in the notification code, an attacker can forcefully hide the notification for pages that have received full screen and pointer lock access.

• What are the potential consequences of this vulnerability?

  This vulnerability could be used for spoofing attacks.

• Where can I find more information about this vulnerability?

  You can find more information about this vulnerability at the following links: [Mozilla Bugzilla](https://bugzilla.mozilla.org/show_bug.cgi?id=1739091), [Mozilla Security Advisory](https://www.mozilla.org/en-US/security/advisories/mfsa2021-54/), [Mozilla Security Advisory](https://www.mozilla.org/en-US/security/advisories/mfsa2021-52/).