CVE-2020-15654: When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not

Description

When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not. This could lead to a perceived broken state, especially when interactions with existing browser dialogs and warnings do not work. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

None

Integrity

High

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.4% · higher than 73% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

FI

Firefox · Mozilla

before 79.0 · source: NVD

FE

Firefox Esr · Mozilla

before 78.1 · source: NVD

TH

Thunderbird · Mozilla

before 78.1 · source: NVD

UL

Ubuntu Linux · Canonical

16.04; 18.04; 20.04 · source: NVD