Skip to content
Fencer Vulns
medium 6.5

CVE-2020-15682 json

When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what application to open it in.

published 2020-10-22 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-7669

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits
0
none known

Summary

When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what application to open it in. An attacker could induce that prompt to be associated with an origin they didn't control, resulting in a spoofing attack. This was fixed by changing external protocol prompts to be tab-modal while also ensuring they could not be incorrectly associated with a different origin. This vulnerability affects Firefox < 82.

Patch / fix

  • Mozilla Firefox 82
  • firefox Ubuntu 16.04 LTS 82.0+build2-0ubuntu0.16.04.5
  • firefox Ubuntu 18.04 LTS 82.0+build2-0ubuntu0.18.04.1
  • firefox Ubuntu 20.04 LTS 82.0+build2-0ubuntu0.20.04.1

ubuntu advisories UBUNTU-CVE-2020-15682

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • firefox-esr openSUSE Tumbleweed 128.5.1-1.1
  • MozillaFirefox openSUSE Tumbleweed 92.0-1.2

opensuse advisories openSUSE-SU-2024:14572-1openSUSE-SU-2024:10600-1

  • firefox Alpine 3.23, Alpine 3.22, Alpine 3.21 +9 more 82.0-r0
  • librewolf Alpine 3.24, Alpine 3.23, Alpine 3.22 +1 more 82.0-r0

alpine advisories ALPINE-CVE-2020-15682

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • firefox Arch Linux 82.0-1

arch linux advisories AVG-1256

Exploit prediction

0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

  • Mozilla Firefox

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.