CVE-2020-26975

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-01-07 · updated 2026-08-19

Description

When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been specified, leading to attacks such as abusing ambient authority or session fixation. This was resolved by only allowing certain safe-listed headers. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 84.

Affected products

Mozilla Firefox for Android: before 84.0 — fixed in 84.0

How to fix

Upgrade to a fixed version: Mozilla Firefox for Android 84.0. Check the vendor advisory for mitigations.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1661071
https://www.mozilla.org/security/advisories/mfsa2020-54/
https://bugzilla.mozilla.org/show_bug.cgi?id=1661071
https://www.mozilla.org/security/advisories/mfsa2020-54/

Get alerted when CVE-2020-26975 or the next vulnerability affects your stack