CVE-2021-23976
📋 TL;DR
This vulnerability in Firefox for Android allows malicious apps to send crafted intents that trick Firefox into loading webapp manifests from arbitrary file paths and declaring them for other origins. This enables UI spoofing through fullscreen access and potential cross-origin attacks against targeted websites. Only Firefox for Android versions before 86 are affected.
💻 Affected Systems
- Firefox for Android
📦 What is this software?
Firefox by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Attackers could create convincing phishing interfaces that appear as legitimate websites, potentially stealing credentials, session tokens, or sensitive data through UI spoofing and cross-origin attacks.
Likely Case
Malicious apps could display fake login screens or interfaces that mimic legitimate services to harvest user credentials or perform unauthorized actions.
If Mitigated
With proper app isolation and user awareness, impact is limited to potential phishing attempts that users might recognize as suspicious.
🎯 Exploit Status
Requires a malicious app to be installed on the same Android device and send crafted intents to Firefox.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox for Android 86 and later
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2021-07/
Restart Required: Yes
Instructions:
1. Open Google Play Store 2. Search for Firefox 3. Update to version 86 or later 4. Restart Firefox after update
🔧 Temporary Workarounds
Disable app installation from unknown sources
androidPrevents installation of malicious apps that could exploit this vulnerability
Android Settings > Security > Unknown Sources > Disable
Use alternative browser temporarily
androidSwitch to another browser until Firefox is updated
🧯 If You Can't Patch
- Restrict installation of third-party apps to trusted sources only
- Monitor for suspicious app behavior and uninstall unknown apps
🔍 How to Verify
Check if Vulnerable:
Open Firefox for Android, go to Settings > About Firefox, check if version is below 86Check Version:
Not applicable for Android GUIVerify Fix Applied:
Confirm Firefox version is 86 or higher in Settings > About Firefox📡 Detection & Monitoring
Log Indicators:
- Unusual intent handling in Android system logs
- Firefox loading manifests from unexpected file paths
Network Indicators:
- Unexpected cross-origin requests from Firefox to sensitive domains
SIEM Query:
Not typically applicable for mobile app vulnerabilities🔗 References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1684627
- https://security.gentoo.org/glsa/202104-10
- https://www.mozilla.org/security/advisories/mfsa2021-07/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1684627
- https://security.gentoo.org/glsa/202104-10
- https://www.mozilla.org/security/advisories/mfsa2021-07/
