CVE-2020-15650

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-08-10 · updated 2026-06-17

Description

Given an installed malicious file picker application, an attacker was able to overwrite local files and thus overwrite Firefox settings (but not access the previous profile). *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.11.

Affected products

Mozilla Firefox ESR: before 68.11 — fixed in 68.11

How to fix

Upgrade to a fixed version: Mozilla Firefox ESR 68.11. Check the vendor advisory for mitigations.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1652360
https://www.mozilla.org/security/advisories/mfsa2020-31/
https://bugzilla.mozilla.org/show_bug.cgi?id=1652360
https://www.mozilla.org/security/advisories/mfsa2020-31/

Get alerted when CVE-2020-15650 or the next vulnerability affects your stack