CVE-2020-26964

CVE-2020-26964

Medium · published December 9, 2020

CVSS v3.1
6.8
EPSS
1%
Percentile
60.2
In the wild
Unconfirmed
What it is

If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6.0, untrusted apps could have connected to the feature and operated with the privileges of the browser to read and interact with web content. The feature was implemented as a unix domain socket, protected by the Android SELinux policy; however, SELinux was not enforced for versions prior to 6.0. This was fixed by removing the Remote Debugging via USB feature from affected devices. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00929 · 60.2th percentile
Published
2020-12-09T06:15Z
Affected products (1)
ProductVersionsFixed in
mozilla/firefox_mobile< 83.083.0
References (4)
https://bugzilla.mozilla.org/show_bug.cgi?id=1658865 · [email protected]https://www.mozilla.org/security/advisories/mfsa2020-50/ · [email protected]https://bugzilla.mozilla.org/show_bug.cgi?id=1658865 · af854a3a-2127-422b-91ae-364da2661108https://www.mozilla.org/security/advisories/mfsa2020-50/ · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 09 DEC 00:24Z
    If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6.0, untrusted apps could have connected to…
    cvelistv5