External Protocol Navigation Vulnerability in Firefox and Focus Apps
CVE-2023-29540

6.1MEDIUM

Key Information:

Vendor

Mozilla
Status
Firefox for Android
Firefox
Focus for Android
Vendor
CVE Published:
2 June 2023

What is CVE-2023-29540?

A vulnerability in the Firefox web browser and Focus application can be exploited through a redirect embedded in sourceMappingUrls. This flaw allows navigation to external protocol links within sandboxed iframes, bypassing the restriction implemented by the 'allow-top-navigation-to-custom-protocols' setting. The issue affects various versions of Firefox for Android and Focus for Android below version 112, presenting significant security concerns for users of these applications.

Affected Version(s)

Firefox < 112

Firefox for Android < 112

Focus for Android < 112

References

https://www.mozilla.org/security/advisories/mfsa2023-13/
https://bugzilla.mozilla.org/show_bug.cgi?id=1790542

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2023-29540 : External Protocol Navigation Vulnerability in Firefox and Focus Apps