CVE-2020-15664: mozilla firefox Incorrect Authorization
Vulnerability summary
CVE-2020-15664 is a medium (CVSS 6.5) Incorrect Authorization vulnerability in mozilla firefox. EPSS estimates a 1.39% chance of exploitation in the next 30 days, higher than 71.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 29 · Related 13Timeline
- 01-10-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to prompt the user to install an extension. Combined with user confusion, this could result in an unintended or malicious extension being installed. This vulnerability affects Firefox < 80, Thunderbird < 78.2, Thunderbird < 68.12, Firefox ESR < 68.12, Firefox ESR < 78.2, and Firefox for Android < 80.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS trend
Probability
1.39%
Chance of exploitation in the next 30 days
Percentile
72%
Versus all other CVEs
30-day change
+0.01 pp
From 1.38% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Mozilla5 products
- firefox≥ unspecified, < 80 | < 80.0 | ≥ 78.0, < 78.2
- firefox_esr≥ unspecified, < 68.12 | ≥ unspecified, < 78.2 | < 68.12
- firefox for android≥ unspecified, < 80
- firefox_mobile< 80.0
- thunderbird≥ unspecified, < 78.2 | ≥ unspecified, < 68.12 | < 68.12 | ≥ 78.0, < 78.2
Ubuntu5 products
- firefox< 80.0+build2-0ubuntu0.16.04.1 | < 80.0+build2-0ubuntu0.18.04.1 | < 80.0+build2-0ubuntu0.20.04.1
- mozjs38All versions (No fix recorded)
- mozjs52All versions (No fix recorded)
- mozjs68All versions (No fix recorded)
- thunderbird< 1:78.8.1+build1-0ubuntu0.18.04.1 | < 1:78.7.1+build1-0ubuntu0.20.04.1
Debian2 products
- firefox-esr< 68.12.0esr-1
- thunderbird< 1:68.12.0-1
3 vendors · 12 products
References
15 links- bugzilla.mozilla.org/show_bug.cgi?id=1658214X Refsource MISCIssue TrackingPermissions RequiredVendor Advisory
