{"cve":"CVE-2020-15682","nvd":{"published":"2020-10-22T21:15:13.433","modified":"2026-06-17T02:57:02.723","status":"Modified","description":"When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what application to open it in. An attacker could induce that prompt to be associated with an origin they didn't control, resulting in a spoofing attack. This was fixed by changing external protocol prompts to be tab-modal while also ensuring they could not be incorrectly associated with a different origin. This vulnerability affects Firefox < 82.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","score":6.5},"cwes":["CWE-346"],"references":["https://bugzilla.mozilla.org/show_bug.cgi?id=1636654","https://www.mozilla.org/security/advisories/mfsa2020-45/","https://bugzilla.mozilla.org/show_bug.cgi?id=1636654","https://www.mozilla.org/security/advisories/mfsa2020-45/"],"products":["mozilla:firefox"],"source":"nvd","synced_at":"2026-10-19T21:09:53.489947993+00:00"},"epss":{"cve":"CVE-2020-15682","score":0.0048,"percentile":0.41467,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}