CVE-2021-38497
6.5 MEDIUMThrough use of reportValidity() and window.open(), a plain-text validation message could have been overlaid on another origin, leading to...
Published: 2021-11-03 · Last updated: 2026-06-17
Severity and scoring
- CVSS
- 6.5 MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- CWE
- CWE-346
Affected products
| Vendor | Product |
|---|---|
| mozilla | firefox, firefox_esr, thunderbird |
Description
Through use of reportValidity() and window.open(), a plain-text validation message could have been overlaid on another origin, leading to possible user confusion and spoofing attacks. This vulnerability affects Firefox < 93, Thunderbird < 91.2, and Firefox ESR < 91.2.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-38497
- [Vendor advisory]https://bugzilla.mozilla.org/show_bug.cgi?id=1726621
- [Vendor advisory]https://www.mozilla.org/security/advisories/mfsa2021-43/
- [Vendor advisory]https://www.mozilla.org/security/advisories/mfsa2021-45/
- [Vendor advisory]https://www.mozilla.org/security/advisories/mfsa2021-47/
- [Vendor advisory]https://bugzilla.mozilla.org/show_bug.cgi?id=1726621
- [Vendor advisory]https://www.mozilla.org/security/advisories/mfsa2021-43/
- [Vendor advisory]https://www.mozilla.org/security/advisories/mfsa2021-45/
- [Vendor advisory]https://www.mozilla.org/security/advisories/mfsa2021-47/
Related CVEs
Same vendor
- CVE-2026-12330 — Incorrect boundary conditions in the Internationalization component (5.4 MEDIUM)
- CVE-2026-12329 — Memory safety bug fixed in Thunderbird ESR 140.12 (5.3 MEDIUM)
- CVE-2026-12328 — Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151 (8.1 HIGH)
- CVE-2026-12323 — Spoofing issue in the DOM: Core & HTML component (5.4 MEDIUM)
- CVE-2026-12322 — Clickjacking issue in the Widget: Gtk component (5.4 MEDIUM)
Same CWE
- CVE-2026-12304 — Same-origin policy bypass in the Networking: Cookies component (9.1 CRITICAL)
- CVE-2026-47825 — Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios (8.6 HIGH)
- CVE-2026-9595 — Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g (5.3 MEDIUM)
- CVE-2026-11624 — The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent...
- CVE-2026-45173 — Idira Identity Browser Extension (Chrome, Firefox, and Edge builds) versions prior to 26.8.1 exhibit an origin validation flaw within its...