CVE-2023-6868

In some instances, the user-agent would allow push requests which lacked a valid VAPID even though the push manager subscription defined one

published December 19, 2023

CVSS
—
EPSS
0%
Percentile
41.4
In the wild
Unconfirmed
What it is

In some instances, the user-agent would allow push requests which lacked a valid VAPID even though the push manager subscription defined one. This could allow empty messages to be sent from unauthorized parties.

*This bug only affects Firefox on Android.* This vulnerability affects Firefox < 121.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00493 · 41.4th percentile
Published
2023-12-19T13:38Z
EPSS history
Timeline
  • 19 DEC 13:38Z
    In some instances, the user-agent would allow push requests which lacked a valid VAPID even though the push manager subscription defined one
    cvelistv5