The default webcal: protocol handler will load a web site vulnerable to cross-site scripting (XSS) attacks. This default was left in place as a legacy feature and has now been removed. Note: this issue only affects users with an account on the vulnerable service. Other users are unaffected.. This vulnerability affects Firefox < 67.
[
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "67",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
]