When clicking on a tel: link, USSD codes, specified after a <code>*</code> character, would be included in the phone number. On certain phones, or on certain carriers, if the number was dialed this could perform actions on a user’s account, similar to a cross-site request forgery attack.<br>This bug only affects Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox < 97.
[
{
"vendor": "Mozilla",
"product": "Firefox",
"versions": [
{
"version": "unspecified",
"lessThan": "97",
"status": "affected",
"versionType": "custom"
}
]
}
]