CVE-2021-43531

When a user loaded a Web Extensions context menu, the Web Extension could access the post-redirect URL of the element clicked

published December 8, 2021

CVSS
—
EPSS
0%
Percentile
26.2
In the wild
Unconfirmed
What it is

When a user loaded a Web Extensions context menu, the Web Extension could access the post-redirect URL of the element clicked. If the Web Extension lacked the WebRequest permission for the hosts involved in the redirect, this would be a same-origin-violation leaking data the Web Extension should have access to. This was fixed to provide the pre-redirect URL. This is related to CVE-2021-43532 but in the context of Web Extensions. This vulnerability affects Firefox < 94.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00340 · 26.2th percentile
Published
2021-12-08T21:20Z
EPSS history
Timeline
  • 08 DEC 21:20Z
    When a user loaded a Web Extensions context menu, the Web Extension could access the post-redirect URL of the element clicked
    cvelistv5