CVE-2021-23984

State: Published
Severity: Not scored
Published: Mar 31, 2021
Updated: Aug 3, 2024
Reserved: Jan 13, 2021

Description

A malicious extension could have opened a popup window lacking an address bar. The title of the popup lacking an address bar should not be fully controllable, but in this situation was. This could have been used to spoof a website and attempt to trick the user into providing credentials. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
Firefox ESRMozilla	before 78.9Affected
FirefoxMozilla	before 87Affected
ThunderbirdMozilla	before 78.9Affected

References

https://www.mozilla.org/security/advisories/mfsa2021-10/
https://www.mozilla.org/security/advisories/mfsa2021-12/
https://www.mozilla.org/security/advisories/mfsa2021-11/
https://bugzilla.mozilla.org/show_bug.cgi?id=1693664

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.