CVE-2021-43532

The 'Copy Image Link' context menu action would copy the final image URL after redirects. By embedding an image that triggered authentication flows - in conjunction with a Content Security Policy that stopped a redirection chain in the middle - the final image URL could be one that contained an authentication token used to takeover a user account. If a website tricked a user into copy and pasting the image link back to the page, the page would be able to steal the authentication tokens. This was fixed by making the action return the original URL, before any redirects. This vulnerability affects Firefox < 94.

• CWE-601

• https://bugzilla.mozilla.org/show_bug.cgi?id=1719203Issue Tracking, Permissions Required, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2021-48/Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1719203Issue Tracking, Permissions Required, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2021-48/Vendor Advisory

Published

Dec 8, 2021

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43527NSS (Network Security Services) versions prior to 3.73 or 3.…9.8
• CVE-2021-43528Thunderbird unexpectedly enabled JavaScript in the compositi…6.5
• CVE-2021-43529Thunderbird versions prior to 91.3.0 are vulnerable to the h…9.8
• CVE-2021-4353The WooCommerce Dynamic Pricing and Discounts plugin for Wor…5.3
• CVE-2021-43530A Universal XSS vulnerability was present in Firefox for And…6.1
• CVE-2021-43531When a user loaded a Web Extensions context menu, the Web Ex…4.3
• CVE-2021-43533When parsing internationalized domain names, high bits of th…4.3
• CVE-2021-43534Mozilla developers and community members reported memory saf…8.8
• CVE-2021-43535A use-after-free could have occured when an HTTP2 session ob…8.8
• CVE-2021-43536Under certain circumstances, asynchronous functions could ha…6.5
• CVE-2021-43537An incorrect type conversion of sizes from 64bit to 32bit in…8.8
• CVE-2021-43538By misusing a race in our notification code, an attacker cou…4.3