SB2020112912 - Spoofing attack in firefox (Alpine package)
Published: November 29, 2020
Security Bulletin ID
SB2020112912
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Spoofing attack (CVE-ID: CVE-2020-26954)
The vulnerability allows a local application to perform spoofing attack.
The vulnerability exists due to incorrect processing of web manifests. When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites.
Remediation
Install update from vendor's website.