Read the docs
TI-2020-16387 Aliases CVE-2020-26964GHSA-3x56-fp32-hw97

If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android…

Priority LOW 32Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6.0, untrusted apps could have connected to the feature and operated with the privileges of the browser to read and interact with web content. The feature was implemented as a unix domain socket, protected by the Android SELinux policy; however, SELinux was not enforced for versions prior to 6.0. This was fixed by removing the Remote Debugging via USB feature from affected devices. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83.

Why it matters now

EPSS 0.00929 60th percentileScored 2026-11-07
Fix Fixed Firefox (Mozilla): 83

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MozillaFirefoxbefore 8383Patch availableCNA
  • Firefox VendorMozilla Affected before 83 Fixed in 83 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:mozilla:firefox_mobile:*:*:*:*:*:android:*:*before 83.0VulnerableMozilla
cpe:2.3:o:google:android:*:*:*:*:*:*:*:*before 6.0Running onGoogle
  • cpe:2.3:a:mozilla:firefox_mobile:*:*:*:*:*:android:*:* Versions before 83.0 Vulnerable ·Mozilla
  • cpe:2.3:o:google:android:*:*:*:*:*:*:*:* Versions before 6.0 Running on ·Google

Remediation

  • Fix · CNA Firefox (Mozilla) Fixed in 83

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-26964
  2. 2026-10-03 Alias added: GHSA-3x56-fp32-hw97

References

Advisory 2

  • TI-2022-09832 Use after free in Mozilla Firefox KEVCVSS 3.1CRITICAL 9.6
  • TI-2022-09831 Use after free in Mozilla Firefox KEVCVSS 3.1HIGH 8.8
  • TI-2023-13905 Race condition in Mozilla Firefox for Android CVSS 3.1HIGH 7.5
  • TI-2023-13916 A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization… CVSS 3.1MEDIUM 6.5
  • TI-2023-13903 Following a Garbage Collector compaction, weak maps may have been accessed before they… CVSS 3.1MEDIUM 6.5
  • TI-2022-13642 Information disclosure in Mozilla Firefox for iOS CVSS 3.1MEDIUM 6.5
See all 86 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences