CVE-2021-23999

If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to web content. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.

Affected

Mozilla · Firefox ESR · Thunderbird · Firefox

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

1.37% chance of exploitation in the next 30 days, 72nd percentile

Published

2021-06-24

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://bugzilla.mozilla.org/show_bug.cgi?id=1691153

Security advisories

• https://www.mozilla.org/security/advisories/mfsa2021-14
• https://www.mozilla.org/security/advisories/mfsa2021-15
• https://www.mozilla.org/security/advisories/mfsa2021-16

References

• CVE Record
• NVD entry