vulnerability

Red Hat: CVE-2020-35111: CVE-2020-35111 Mozilla: The proxy.onRequest API did not catch view-source URLs (Multiple Advisories)

Name: Red Hat: CVE-2020-35111: CVE-2020-35111 Mozilla: The proxy.onRequest API did not catch view-source URLs (Multiple Advisories)
Creator: Red Hat
Published: 2020-12-16T00:00:00.000Z
Keywords: CVE, Red Hat, 2020, 35111, 35111 Mozilla, redhat-upgrade-firefox, redhat-upgrade-firefox-debuginfo, redhat-upgrade-firefox-debugsource, redhat-upgrade-thunderbird, redhat-upgrade-thunderbird-debuginfo, redhat-upgrade-thunderbird-debugsource, Severity 4

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:M/Au:N/C:P/I:N/A:N)

Published

Dec 16, 2020

Added

Dec 21, 2020

Modified

Mar 27, 2026

Description

When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback was not triggered for view-source URLs. While web content cannot navigate to such URLs, a user opening View Source could have inadvertently leaked their IP address. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6.

Solutions

redhat-upgrade-firefoxredhat-upgrade-firefox-debuginforedhat-upgrade-firefox-debugsourceredhat-upgrade-thunderbirdredhat-upgrade-thunderbird-debuginforedhat-upgrade-thunderbird-debugsource

References

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report