What is CVE-2020-26962?

CVE-2020-26962 is a medium-severity vulnerability in Mozilla Firefox, classified under Improper Restriction of Rendered UI Layers or Frames (Clickjacking). CVSS score: 6.1/10. Published 2020-12-09.

How severe is CVE-2020-26962?

Medium severity. CVSS v3 base score is 6.1 out of 10.

Vulnerability in Mozilla Firefox

CVE-2020-26962

Cross-origin iframes that contained a login form could have been recognized by the login autofill service, and populated. This could have been used in clickjacking attacks, as well as be read across partitions in dynamic first party isolation. This vulnerability affects Firefox < 83.

EPSS: 0.007 (49.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Mozilla Firefox — versions < 83

Weakness classification (CWE)

CWE-1021 — Improper Restriction of Rendered UI Layers or Frames (Clickjacking)

References

security@mozilla.org (Permissions Required, x_refsource_MISC, Issue Tracking, Vendor Advisory)
security@mozilla.org (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2020-26962?: CVE-2020-26962 is a medium-severity vulnerability in Mozilla Firefox, classified under Improper Restriction of Rendered UI Layers or Frames (Clickjacking). CVSS score: 6.1/10. Published 2020-12-09.
How severe is CVE-2020-26962?: Medium severity. CVSS v3 base score is 6.1 out of 10.