CVE-2021-23999: mozilla firefox Improper Privilege Management
Vulnerability summary
CVE-2021-23999 is a high (CVSS 8.8) Improper Privilege Management vulnerability in mozilla firefox. EPSS estimates a 1.37% chance of exploitation in the next 30 days, higher than 71.4% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 27 · Related 13Timeline
- 24-06-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to web content. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.37%
Chance of exploitation in the next 30 days
Percentile
71%
Versus all other CVEs
30-day change
0.00 pp
From 1.37% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (bugzilla.mozilla.org)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
- CWE-697Incorrect ComparisonThe product compares two entities in a security-relevant context, but the comparison is incorrect.
Affected systems
Ubuntu6 products
- firefox< 88.0+build2-0ubuntu0.16.04.1 | < 88.0+build2-0ubuntu0.18.04.2 | < 88.0+build2-0ubuntu0.20.04.1
- mozjs38All versions (No fix recorded)
- mozjs52All versions (No fix recorded)
- mozjs68All versions (No fix recorded)
- mozjs78All versions (No fix recorded)
Mozilla3 products
- firefox≥ unspecified, < 88 | < 88.0
- firefox_esr≥ unspecified, < 78.10 | < 78.10
- thunderbird≥ unspecified, < 78.10 | < 78.10
Debian2 products
- firefox-esr< 78.10.0esr-1
- thunderbird< 1:78.10.0-1
3 vendors · 11 products
