CVE-2020-15650: Given an installed malicious file picker application, an attacker was able to overwrite local files and thus overwrite Firefox settings (but not access the previous profile)

Description

Given an installed malicious file picker application, an attacker was able to overwrite local files and thus overwrite Firefox settings (but not access the previous profile). *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.11.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack vector

Local

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

None

Integrity

High

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.6% · higher than 50% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

FE

Firefox Esr · Mozilla

before 68.11 · source: NVD