CVE-2020-15666

When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was disclosed via the MediaError Message. This level of information leakage is inconsistent with the standardized onerror/onsuccess disclosure and can lead to inferring login status to services or device discovery on a local network among other attacks. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

• CWE-209

• https://bugzilla.mozilla.org/show_bug.cgi?id=1450853Exploit, Issue Tracking, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-36/Release Notes, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-39/Release Notes, Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1450853Exploit, Issue Tracking, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-36/Release Notes, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-39/Release Notes, Vendor Advisory

Published

Oct 1, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15660Missing checks on Content-Type headers in geckodriver before…8.8
• CVE-2020-15661A rogue webpage could override the injected WKUserScript use…6.5
• CVE-2020-15662A rogue webpage could override the injected WKUserScript use…6.5
• CVE-2020-15663If Firefox is installed to a user-writable directory, the Mo…8.8
• CVE-2020-15664By holding a reference to the eval() function from an about:…6.5
• CVE-2020-15665Firefox did not reset the address bar after the beforeunload…4.3
• CVE-2020-15667When processing a MAR update file, after the signature has b…8.8
• CVE-2020-15668A lock was missing when accessing a data structure and impor…4.3
• CVE-2020-15669When aborting an operation, such as a fetch, an abort signal…8.8
• CVE-2020-1567A remote code execution vulnerability exists in the way that…4.2
• CVE-2020-15670Mozilla developers reported memory safety bugs present in Fi…8.8
• CVE-2020-15671When typing in a password under certain conditions, a race m…3.1