CVE-2020-26976

When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former, the service worker could have intercepted the request for the secure page despite the iframe not being a secure context due to the (insecure) framing. This vulnerability affects Firefox < 84.

• https://bugzilla.mozilla.org/show_bug.cgi?id=1674343Issue Tracking, Permissions Required, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2021/02/msg00001.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/02/msg00002.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202102-02Third Party Advisory
• https://www.debian.org/security/2021/dsa-4840Third Party Advisory
• https://www.debian.org/security/2021/dsa-4842Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-54/Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1674343Issue Tracking, Permissions Required, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2021/02/msg00001.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/02/msg00002.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202102-02Third Party Advisory
• https://www.debian.org/security/2021/dsa-4840Third Party Advisory
• https://www.debian.org/security/2021/dsa-4842Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-54/Vendor Advisory

Published

Jan 7, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-26970When reading SMTP server status codes, Thunderbird writes an…8.8
• CVE-2020-26971Certain blit values provided by the user were not properly c…8.8
• CVE-2020-26972The lifecycle of IPC Actors allows managed actors to outlive…9.8
• CVE-2020-26973Certain input to the CSS Sanitizer confused it, resulting in…8.8
• CVE-2020-26974When flex-basis was used on a table wrapper, a StyleGenericF…8.8
• CVE-2020-26975When a malicious application installed on the user's device …6.5
• CVE-2020-26977By attempting to connect a website using an unresponsive por…6.5
• CVE-2020-26978Using techniques that built on the slipstream research, a ma…6.1
• CVE-2020-26979When a user typed a URL in the address bar or the search bar…6.1
• CVE-2020-2698Vulnerability in the Oracle VM VirtualBox product of Oracle …7.5
• CVE-2020-26980A vulnerability has been identified in JT2Go (All versions <…8.8
• CVE-2020-26981A vulnerability has been identified in JT2Go (All versions <…6.5