CVE-2020-26975

6.5 mediumEPSS 0.9%

Medium (6.5) in mozilla firefox mobile. EPSS 0.9% chance of exploitation in the next 30 days.

When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been specified, leading to attacks such as abusing ambient authority or session fixation. This was resolved by only allowing certain safe-listed headers. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 84.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 58% of CVEs (scores of 2026-10-31)
Published: 2021-01-07
Modified: 2026-08-19
Record from: the NVD, synced 2026-10-19

Affected

mozilla:firefox_mobile

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1661071
https://www.mozilla.org/security/advisories/mfsa2020-54/
https://bugzilla.mozilla.org/show_bug.cgi?id=1661071
https://www.mozilla.org/security/advisories/mfsa2020-54/

Check your stack JSON