CVE-2021-23986

A malicious extension with the 'search' permission could have installed a new search engine whose favicon referenced a cross-origin URL. The response to this cross-origin request could have been read by the extension, allowing a same-origin policy bypass by the extension, which should not have cross-origin permissions. This cross-origin request was made without cookies, so the sensitive information disclosed by the violation was limited to local-network resources or resources that perform IP-based authentication. This vulnerability affects Firefox < 87.

• CWE-346

• https://bugzilla.mozilla.org/show_bug.cgi?id=1692623Issue Tracking, Permissions Required, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2021-10/Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1692623Issue Tracking, Permissions Required, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2021-10/Vendor Advisory

Published

Mar 31, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-23980A mutation XSS affects users calling bleach.clean with all o…6.1
• CVE-2021-23981A texture upload of a Pixel Buffer Object could have confuse…8.1
• CVE-2021-23982Using techniques that built on the slipstream research, a ma…6.5
• CVE-2021-23983By causing a transition on a parent node by removing a CSS r…6.5
• CVE-2021-23984A malicious extension could have opened a popup window lacki…6.5
• CVE-2021-23985If an attacker is able to alter specific about:config values…6.5
• CVE-2021-23987Mozilla developers and community members reported memory saf…8.8
• CVE-2021-23988Mozilla developers reported memory safety bugs present in Fi…8.8
• CVE-2021-2399Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2021-23991If a Thunderbird user has previously imported Alice's OpenPG…6.8
• CVE-2021-23992Thunderbird did not check if the user ID associated with an …4.3
• CVE-2021-23993An attacker may perform a DoS attack to prevent a user from …6.5