CVE-2020-15682

When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what application to open it in. An attacker could induce that prompt to be associated with an origin they didn't control, resulting in a spoofing attack. This was fixed by changing external protocol prompts to be tab-modal while also ensuring they could not be incorrectly associated with a different origin. This vulnerability affects Firefox < 82.

• CWE-346

• https://bugzilla.mozilla.org/show_bug.cgi?id=1636654Issue Tracking, Permissions Required, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-45/Release Notes, Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1636654Issue Tracking, Permissions Required, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-45/Release Notes, Vendor Advisory

Published

Oct 22, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15677By exploiting an Open Redirect vulnerability on a website, a…6.1
• CVE-2020-15678When recursing through graphical layers while scrolling, an …8.8
• CVE-2020-15679An OAuth session fixation vulnerability existed in the VPN l…7.6
• CVE-2020-1568A remote code execution vulnerability exists when Microsoft …7.5
• CVE-2020-15680If a valid external protocol handler was referenced in an im…5.3
• CVE-2020-15681When multiple WASM threads had a reference to a module, and …7.5
• CVE-2020-15683Mozilla developers and community members reported memory saf…9.8
• CVE-2020-15684Mozilla developers reported memory safety bugs present in Fi…9.8
• CVE-2020-15685During the plaintext phase of the STARTTLS connection setup,…8.8
• CVE-2020-15687Missing access control restrictions in the Hypervisor compon…7.5
• CVE-2020-15688The HTTP Digest Authentication in the GoAhead web server bef…8.8
• CVE-2020-15689Appweb before 7.2.2 and 8.x before 8.1.0, when built with CG…7.5