What’s Vulnerable › Vulnerabilities

CVE-2021-23999

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-06-24 · updated 2026-06-17
• Weakness: CWE-269

Description

If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to web content. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.

Affected products

• Mozilla Firefox: before 88.0 — fixed in 88.0
• Mozilla Firefox ESR: before 78.10 — fixed in 78.10
• Mozilla Thunderbird: before 78.10 — fixed in 78.10

How to fix

Upgrade to a fixed version: Mozilla Firefox 88.0; Mozilla Firefox ESR 78.10; Mozilla Thunderbird 78.10. Check the vendor advisory for mitigations.

References

• https://bugzilla.mozilla.org/show_bug.cgi?id=1691153
• https://www.mozilla.org/security/advisories/mfsa2021-14/
• https://www.mozilla.org/security/advisories/mfsa2021-15/
• https://www.mozilla.org/security/advisories/mfsa2021-16/
• https://bugzilla.mozilla.org/show_bug.cgi?id=1691153
• https://www.mozilla.org/security/advisories/mfsa2021-14/
• https://www.mozilla.org/security/advisories/mfsa2021-15/
• https://www.mozilla.org/security/advisories/mfsa2021-16/

Get alerted when CVE-2021-23999 or the next vulnerability affects your stack