CVE-2020-26975

When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been specified, leading to attacks such as abusing ambient authority or session fixation. This was resolved by only allowing certain safe-listed headers. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 84.

• https://bugzilla.mozilla.org/show_bug.cgi?id=1661071Permissions Required
• https://www.mozilla.org/security/advisories/mfsa2020-54/Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1661071Permissions Required
• https://www.mozilla.org/security/advisories/mfsa2020-54/Vendor Advisory

Published

Jan 7, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-2697Vulnerability in the Oracle Hospitality Suites Management co…4.9
• CVE-2020-26970When reading SMTP server status codes, Thunderbird writes an…8.8
• CVE-2020-26971Certain blit values provided by the user were not properly c…8.8
• CVE-2020-26972The lifecycle of IPC Actors allows managed actors to outlive…9.8
• CVE-2020-26973Certain input to the CSS Sanitizer confused it, resulting in…8.8
• CVE-2020-26974When flex-basis was used on a table wrapper, a StyleGenericF…8.8
• CVE-2020-26976When a HTTPS pages was embedded in a HTTP page, and there wa…6.5
• CVE-2020-26977By attempting to connect a website using an unresponsive por…6.5
• CVE-2020-26978Using techniques that built on the slipstream research, a ma…6.1
• CVE-2020-26979When a user typed a URL in the address bar or the search bar…6.1
• CVE-2020-2698Vulnerability in the Oracle VM VirtualBox product of Oracle …7.5
• CVE-2020-26980A vulnerability has been identified in JT2Go (All versions <…8.8