CVE-2020-15649

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-08-10 · updated 2026-06-17
Weakness: CWE-434

Description

Given an installed malicious file picker application, an attacker was able to steal and upload local files of their choosing, regardless of the actually files picked. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.11.

Affected products

Mozilla Firefox ESR: before 68.11 — fixed in 68.11

How to fix

Upgrade to a fixed version: Mozilla Firefox ESR 68.11. Check the vendor advisory for mitigations.

References

https://bugzilla.mozilla.org/buglist.cgi?bug_id=1475835%2C1652364
https://www.mozilla.org/security/advisories/mfsa2020-31/
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1475835%2C1652364
https://www.mozilla.org/security/advisories/mfsa2020-31/

Get alerted when CVE-2020-15649 or the next vulnerability affects your stack