CVE-2021-43531

2021-12-0821:20:58

mozilla

www.cve.org

web extension context

same-origin-violation

data leakage

firefox < 94

AI Score

4.9

Confidence

High

EPSS

0.001

Percentile

36.7%

JSON

When a user loaded a Web Extensions context menu, the Web Extension could access the post-redirect URL of the element clicked. If the Web Extension lacked the WebRequest permission for the hosts involved in the redirect, this would be a same-origin-violation leaking data the Web Extension should have access to. This was fixed to provide the pre-redirect URL. This is related to CVE-2021-43532 but in the context of Web Extensions. This vulnerability affects Firefox < 94.

CNA Affected

[
  {
    "product": "Firefox",
    "vendor": "Mozilla",
    "versions": [
      {
        "lessThan": "94",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]