The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
A malicious extension with the 'search' permission could have installed a new search engine whose favicon referenced a cross-origin URL. The response to this cross-origin request could have been read by the extension, allowing a same-origin policy bypass by the extension, which should not have cross-origin permissions. This cross-origin request was made without cookies, so the sensitive information disclosed by the violation was limited to local-network resources or resources that perform IP-based authentication. This vulnerability affects Firefox < 87.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade librewolfUpgrade firefox | Aug 22, 2024 | Mar 31, 2021 |
| Gentoo Linux | — | Upgrade www-client/firefox.Upgrade www-client/firefox-bin. | May 3, 2021 | Mar 31, 2021 |
| Mfsa2021 10 | — | Upgrade to Mozilla Firefox version 87.0Upgrade to the latest version of Mozilla Firefox | Mar 24, 2021 | Mar 23, 2021 |
| Ubuntu | — | Upgrade firefox | Mar 26, 2021 | Mar 25, 2021 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub