CVE-2021-23984

A malicious extension could have opened a popup window lacking an address bar. The title of the popup lacking an address bar should not be fully controllable, but in this situation was. This could have been used to spoof a website and attempt to trick the user into providing credentials. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9.

• CWE-290

• https://bugzilla.mozilla.org/show_bug.cgi?id=1693664Issue Tracking, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2021-10/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2021-11/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2021-12/Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1693664Issue Tracking, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2021-10/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2021-11/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2021-12/Vendor Advisory

Published

Mar 31, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-23979Mozilla developers reported memory safety bugs present in Fi…8.8
• CVE-2021-2398Vulnerability in the Oracle Advanced Outbound Telephony prod…8.1
• CVE-2021-23980A mutation XSS affects users calling bleach.clean with all o…6.1
• CVE-2021-23981A texture upload of a Pixel Buffer Object could have confuse…8.1
• CVE-2021-23982Using techniques that built on the slipstream research, a ma…6.5
• CVE-2021-23983By causing a transition on a parent node by removing a CSS r…6.5
• CVE-2021-23985If an attacker is able to alter specific about:config values…6.5
• CVE-2021-23986A malicious extension with the 'search' permission could hav…6.5
• CVE-2021-23987Mozilla developers and community members reported memory saf…8.8
• CVE-2021-23988Mozilla developers reported memory safety bugs present in Fi…8.8
• CVE-2021-2399Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2021-23991If a Thunderbird user has previously imported Alice's OpenPG…6.8