CVE-2020-15682

6.5 mediumEPSS 0.5%

Medium (6.5) in mozilla firefox. EPSS 0.5% chance of exploitation in the next 30 days.

When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what application to open it in. An attacker could induce that prompt to be associated with an origin they didn't control, resulting in a spoofing attack. This was fixed by changing external protocol prompts to be tab-modal while also ensuring they could not be incorrectly associated with a different origin. This vulnerability affects Firefox < 82.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-31)
CWE: CWE-346
Published: 2020-10-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mozilla:firefox

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1636654
https://www.mozilla.org/security/advisories/mfsa2020-45/
https://bugzilla.mozilla.org/show_bug.cgi?id=1636654
https://www.mozilla.org/security/advisories/mfsa2020-45/

Check your stack JSON