# Mozilla Firefox ESR (en-US) 91.0 Mozilla Firefox ESR (en-US) 91.0, released August 4, 2021, fixes 129 CVEs in Mozilla Firefox ESR (en-US). None of them is reported as exploited. Patch Radar priority: Urgent. The latest Mozilla Firefox ESR (en-US) is 153.6.0, which also fixes every one of these CVEs. - Web page: https://patchblox.com/security/fix/windows-app/mozilla.firefox.esr-91.0 - Platform: Windows apps - Released: Aug 4, 2021 - Priority: Urgent (Closes CVE-2020-26950, rated Critical) - CVEs: 129, exploited: 0, on CISA KEV: 0 - Superseded by: [Mozilla Firefox ESR (en-US) 153.6.0](https://patchblox.com/security/data/product/windows-app/mozilla-firefox-esr-en-us.md), the latest version, which also fixes every CVE listed here ## Applies to | Product | Release | Fixed in | |---|---|---| | [Mozilla Firefox ESR (en-US)](https://patchblox.com/security/data/product/windows-app/mozilla-firefox-esr-en-us.md) | | 91.0 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2020-26950](https://patchblox.com/security/data/cve/CVE-2020-26950.md) | Urgent | Firefox ESR and 2 others: In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting… | 8.8 | 0.4233 | | | [CVE-2021-23978](https://patchblox.com/security/data/cve/CVE-2021-23978.md) | Urgent | Firefox ESR and 2 others: Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. | 8.8 | 0.0153 | | | [CVE-2021-29967](https://patchblox.com/security/data/cve/CVE-2021-29967.md) | Urgent | Firefox ESR and 3 others: Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11. | 8.8 | 0.0137 | | | [CVE-2021-23973](https://patchblox.com/security/data/cve/CVE-2021-23973.md) | Urgent | Firefox ESR and 2 others: When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted,… | 6.5 | 0.0137 | | | [CVE-2021-23968](https://patchblox.com/security/data/cve/CVE-2021-23968.md) | Urgent | Firefox ESR and 2 others: If Content Security Policy blocked frame navigation, the full destination of a redirect served in the… | 4.3 | 0.0131 | | | [CVE-2021-23969](https://patchblox.com/security/data/cve/CVE-2021-23969.md) | Urgent | Firefox ESR and 2 others: As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents… | 4.3 | 0.0121 | | | [CVE-2020-15663](https://patchblox.com/security/data/cve/CVE-2020-15663.md) | High | Firefox ESR and 2 others: If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe… | 8.8 | 0.0272 | | | [CVE-2020-15683](https://patchblox.com/security/data/cve/CVE-2020-15683.md) | High | Firefox ESR and 2 others: Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox… | 9.8 | 0.0267 | | | [CVE-2020-15659](https://patchblox.com/security/data/cve/CVE-2020-15659.md) | High | Firefox ESR and 2 others: Mozilla developers and community members reported memory safety bugs present in Firefox 78 and Firefox… | 8.8 | 0.0239 | | | [CVE-2020-15673](https://patchblox.com/security/data/cve/CVE-2020-15673.md) | High | Firefox ESR and 2 others: Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. | 8.8 | 0.0196 | | | [CVE-2020-26971](https://patchblox.com/security/data/cve/CVE-2020-26971.md) | High | Firefox ESR and 2 others: Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow… | 8.8 | 0.0190 | | | [CVE-2020-15678](https://patchblox.com/security/data/cve/CVE-2020-15678.md) | High | Firefox ESR and 2 others: When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting… | 8.8 | 0.0188 | | | [CVE-2021-23994](https://patchblox.com/security/data/cve/CVE-2021-23994.md) | High | Firefox ESR and 2 others: A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound… | 8.8 | 0.0176 | | | [CVE-2020-15667](https://patchblox.com/security/data/cve/CVE-2020-15667.md) | High | Firefox ESR and 1 other: When processing a MAR update file, after the signature has been validated, an invalid name length could… | 8.8 | 0.0165 | | | [CVE-2020-26973](https://patchblox.com/security/data/cve/CVE-2020-26973.md) | High | Firefox ESR and 2 others: Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. | 8.8 | 0.0162 | | | [CVE-2020-35113](https://patchblox.com/security/data/cve/CVE-2020-35113.md) | High | Firefox ESR and 2 others: Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5. | 8.8 | 0.0157 | | | [CVE-2020-26960](https://patchblox.com/security/data/cve/CVE-2020-26960.md) | High | Firefox ESR and 2 others: If the Compact() method was called on an nsTArray, the array could have been reallocated without updating… | 8.8 | 0.0156 | | | [CVE-2020-26974](https://patchblox.com/security/data/cve/CVE-2020-26974.md) | High | Firefox ESR and 2 others: When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly… | 8.8 | 0.0153 | | | [CVE-2020-15656](https://patchblox.com/security/data/cve/CVE-2020-15656.md) | High | Firefox ESR and 2 others: JIT optimizations involving the Javascript arguments object could confuse later optimizations. | 8.8 | 0.0152 | | | [CVE-2020-26968](https://patchblox.com/security/data/cve/CVE-2020-26968.md) | High | Firefox ESR and 2 others: Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. | 8.8 | 0.0151 | | | [CVE-2021-23961](https://patchblox.com/security/data/cve/CVE-2021-23961.md) | High | Firefox ESR and 1 other: Further techniques that built on the slipstream research combined with a malicious webpage could have… | 7.4 | 0.0148 | | | [CVE-2021-29985](https://patchblox.com/security/data/cve/CVE-2021-29985.md) | High | Firefox ESR and 3 others: A use-after-free vulnerability in media channels could have led to memory corruption and a potentially… | 8.8 | 0.0145 | | | [CVE-2021-29970](https://patchblox.com/security/data/cve/CVE-2021-29970.md) | High | Firefox ESR and 3 others: A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable… | 8.8 | 0.0143 | | | [CVE-2021-23987](https://patchblox.com/security/data/cve/CVE-2021-23987.md) | High | Firefox ESR and 2 others: Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox… | 8.8 | 0.0142 | | | [CVE-2021-29980](https://patchblox.com/security/data/cve/CVE-2021-29980.md) | High | Firefox ESR and 3 others: Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption… | 8.8 | 0.0140 | | | [CVE-2021-29984](https://patchblox.com/security/data/cve/CVE-2021-29984.md) | High | Firefox ESR and 3 others: Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly… | 8.8 | 0.0139 | | | [CVE-2021-29988](https://patchblox.com/security/data/cve/CVE-2021-29988.md) | High | Firefox ESR and 3 others: Firefox incorrectly treated an inline list-item element as a block element, resulting in an out of bounds… | 8.8 | 0.0138 | | | [CVE-2021-23999](https://patchblox.com/security/data/cve/CVE-2021-23999.md) | High | Firefox ESR and 2 others: If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System… | 8.8 | 0.0137 | | | [CVE-2021-23964](https://patchblox.com/security/data/cve/CVE-2021-23964.md) | High | Firefox ESR and 2 others: Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. | 8.8 | 0.0136 | | | [CVE-2020-15684](https://patchblox.com/security/data/cve/CVE-2020-15684.md) | High | Firefox ESR and 1 other: Mozilla developers reported memory safety bugs present in Firefox 81. | 9.8 | 0.0135 | | | [CVE-2020-26972](https://patchblox.com/security/data/cve/CVE-2020-26972.md) | High | Firefox ESR and 1 other: The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must… | 9.8 | 0.0131 | | | [CVE-2021-29946](https://patchblox.com/security/data/cve/CVE-2021-29946.md) | High | Firefox ESR and 2 others: Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed… | 8.8 | 0.0130 | | | [CVE-2020-26959](https://patchblox.com/security/data/cve/CVE-2020-26959.md) | High | Firefox ESR and 2 others: During browser shutdown, reference decrementing could have occured on a previously freed object, resulting… | 8.8 | 0.0130 | | | [CVE-2021-23960](https://patchblox.com/security/data/cve/CVE-2021-23960.md) | High | Firefox ESR and 2 others: Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and… | 8.8 | 0.0129 | | | [CVE-2020-35112](https://patchblox.com/security/data/cve/CVE-2020-35112.md) | High | Firefox ESR and 2 others: If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads… | 8.8 | 0.0127 | | | [CVE-2021-29989](https://patchblox.com/security/data/cve/CVE-2021-29989.md) | High | Firefox ESR and 3 others: Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12. | 8.8 | 0.0127 | | | [CVE-2021-29976](https://patchblox.com/security/data/cve/CVE-2021-29976.md) | High | Firefox ESR and 3 others: Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird. | 8.8 | 0.0122 | | | [CVE-2020-26969](https://patchblox.com/security/data/cve/CVE-2020-26969.md) | High | Firefox ESR and 1 other: Mozilla developers reported memory safety bugs present in Firefox 82. | 8.8 | 0.0122 | | | [CVE-2021-23954](https://patchblox.com/security/data/cve/CVE-2021-23954.md) | High | Firefox ESR and 2 others: Using the new logical assignment operators in a JavaScript switch statement could have caused a type… | 8.8 | 0.0119 | | | [CVE-2021-23995](https://patchblox.com/security/data/cve/CVE-2021-23995.md) | High | Firefox ESR and 2 others: When Responsive Design Mode was enabled, it used references to objects that were previously freed. | 8.8 | 0.0118 | | | [CVE-2020-26952](https://patchblox.com/security/data/cve/CVE-2020-26952.md) | High | Firefox ESR and 1 other: Incorrect bookkeeping of functions inlined during JIT compilation could have led to memory corruption… | 8.8 | 0.0116 | | | [CVE-2021-23981](https://patchblox.com/security/data/cve/CVE-2021-23981.md) | High | Firefox ESR and 2 others: A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer… | 8.1 | 0.0115 | | | [CVE-2021-24002](https://patchblox.com/security/data/cve/CVE-2021-24002.md) | High | Firefox ESR and 2 others: When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would… | 8.8 | 0.0113 | | | [CVE-2020-15681](https://patchblox.com/security/data/cve/CVE-2020-15681.md) | High | Firefox ESR and 1 other: When multiple WASM threads had a reference to a module, and were looking up exported functions, one WASM… | 7.5 | 0.0109 | | | [CVE-2021-23988](https://patchblox.com/security/data/cve/CVE-2021-23988.md) | High | Firefox ESR and 1 other: Mozilla developers reported memory safety bugs present in Firefox 86. | 8.8 | 0.0108 | | | [CVE-2020-15670](https://patchblox.com/security/data/cve/CVE-2020-15670.md) | High | Firefox ESR and 2 others: Mozilla developers reported memory safety bugs present in Firefox for Android 79. | 8.8 | 0.0107 | | | [CVE-2020-35114](https://patchblox.com/security/data/cve/CVE-2020-35114.md) | High | Firefox ESR and 1 other: Mozilla developers reported memory safety bugs present in Firefox 83. | 8.8 | 0.0105 | | | [CVE-2021-29972](https://patchblox.com/security/data/cve/CVE-2021-29972.md) | High | Firefox ESR and 1 other: A use-after-free vulnerability was found via testing, and traced to an out-of-date Cairo library. | 8.8 | 0.0104 | | | [CVE-2021-29966](https://patchblox.com/security/data/cve/CVE-2021-29966.md) | High | Mozilla Firefox ESR: Mozilla developers reported memory safety bugs present in Firefox 88. | 8.8 | 0.0102 | | | [CVE-2020-15675](https://patchblox.com/security/data/cve/CVE-2020-15675.md) | High | Firefox ESR and 1 other: When processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and… | 8.8 | 0.0101 | | | [CVE-2021-23972](https://patchblox.com/security/data/cve/CVE-2021-23972.md) | High | Firefox ESR and 1 other: One phishing tactic on the web is to provide a link with HTTP Auth. | 8.8 | 0.0101 | | | [CVE-2021-29981](https://patchblox.com/security/data/cve/CVE-2021-29981.md) | High | Firefox ESR and 3 others: An issue present in lowering/register allocation could have led to obscure but deterministic register… | 8.8 | 0.0101 | | | [CVE-2021-29977](https://patchblox.com/security/data/cve/CVE-2021-29977.md) | High | Firefox ESR and 1 other: Mozilla developers reported memory safety bugs present in Firefox 89. | 8.8 | 0.0101 | | | [CVE-2021-29990](https://patchblox.com/security/data/cve/CVE-2021-29990.md) | High | Firefox ESR and 1 other: Mozilla developers and community members reported memory safety bugs present in Firefox 90. | 8.8 | 0.0101 | | | [CVE-2021-23965](https://patchblox.com/security/data/cve/CVE-2021-23965.md) | High | Firefox ESR and 1 other: Mozilla developers reported memory safety bugs present in Firefox 84. | 8.8 | 0.0097 | | | [CVE-2021-23979](https://patchblox.com/security/data/cve/CVE-2021-23979.md) | High | Firefox ESR and 1 other: Mozilla developers reported memory safety bugs present in Firefox 85. | 8.8 | 0.0093 | | | [CVE-2021-23962](https://patchblox.com/security/data/cve/CVE-2021-23962.md) | High | Firefox ESR and 1 other: Incorrect use of the '' method could have led to a user-after-poison and a potentially… | 8.8 | 0.0089 | | | [CVE-2021-29947](https://patchblox.com/security/data/cve/CVE-2021-29947.md) | High | Firefox ESR and 1 other: Mozilla developers and community members reported memory safety bugs present in Firefox 87. | 8.8 | 0.0087 | | | [CVE-2021-29968](https://patchblox.com/security/data/cve/CVE-2021-29968.md) | High | Firefox ESR and 1 other: When drawing text onto a canvas with WebRender disabled, an out of bounds read could occur. | 8.1 | 0.0083 | | | [CVE-2021-23997](https://patchblox.com/security/data/cve/CVE-2021-23997.md) | High | Firefox ESR and 1 other: Due to unexpected data type conversions, a use-after-free could have occurred when interacting with the… | 8.8 | 0.0082 | | | [CVE-2021-29964](https://patchblox.com/security/data/cve/CVE-2021-29964.md) | High | Firefox ESR and 3 others: A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly,… | 7.1 | 0.0082 | | | [CVE-2020-15674](https://patchblox.com/security/data/cve/CVE-2020-15674.md) | High | Firefox ESR and 1 other: Mozilla developers reported memory safety bugs present in Firefox 80. | 8.8 | 0.0081 | | | [CVE-2021-29952](https://patchblox.com/security/data/cve/CVE-2021-29952.md) | High | Firefox ESR and 1 other: When Web Render components were destructed, a race condition could have caused undefined behavior, and… | 7.5 | 0.0074 | | | [CVE-2020-15657](https://patchblox.com/security/data/cve/CVE-2020-15657.md) | High | Firefox ESR and 2 others: Firefox could be made to load attacker-supplied DLL files from the installation directory. | 7.8 | 0.0035 | | | [CVE-2020-16012](https://patchblox.com/security/data/cve/CVE-2020-16012.md) | Routine | Firefox ESR and 1 other: Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote… | 4.3 | 0.0257 | | | [CVE-2021-29951](https://patchblox.com/security/data/cve/CVE-2021-29951.md) | Routine | Firefox ESR and 3 others: The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN\|Users which, in a domain network,… | 6.5 | 0.0185 | | | [CVE-2020-15677](https://patchblox.com/security/data/cve/CVE-2020-15677.md) | Routine | Firefox ESR and 2 others: By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed… | 6.1 | 0.0166 | | | [CVE-2020-26976](https://patchblox.com/security/data/cve/CVE-2020-26976.md) | Routine | Firefox ESR and 1 other: When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former,… | 6.5 | 0.0164 | | | [CVE-2020-15676](https://patchblox.com/security/data/cve/CVE-2020-15676.md) | Routine | Firefox ESR and 2 others: Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting… | 6.1 | 0.0159 | | | [CVE-2020-15655](https://patchblox.com/security/data/cve/CVE-2020-15655.md) | Routine | Firefox ESR and 2 others: A redirected HTTP request which is observed or modified through a web extension could bypass existing… | 6.5 | 0.0152 | | | [CVE-2021-23985](https://patchblox.com/security/data/cve/CVE-2021-23985.md) | Routine | Firefox ESR and 1 other: If an attacker is able to alter specific about:config values (for example malware running on the user's… | 6.5 | 0.0151 | | | [CVE-2021-29955](https://patchblox.com/security/data/cve/CVE-2021-29955.md) | Routine | Firefox ESR and 1 other: A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker… | 5.3 | 0.0148 | | | [CVE-2020-6829](https://patchblox.com/security/data/cve/CVE-2020-6829.md) | Routine | Firefox ESR and 1 other: When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which… | 5.3 | 0.0148 | | | [CVE-2020-35111](https://patchblox.com/security/data/cve/CVE-2020-35111.md) | Routine | Firefox ESR and 2 others: When an extension with the proxy permission registered to receive , the proxy.onRequest callback… | 4.3 | 0.0143 | | | [CVE-2020-15654](https://patchblox.com/security/data/cve/CVE-2020-15654.md) | Routine | Firefox ESR and 2 others: When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user… | 6.5 | 0.0142 | | | [CVE-2020-15653](https://patchblox.com/security/data/cve/CVE-2020-15653.md) | Routine | Firefox ESR and 2 others: An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. | 6.5 | 0.0140 | | | [CVE-2020-15664](https://patchblox.com/security/data/cve/CVE-2020-15664.md) | Routine | Firefox ESR and 2 others: By holding a reference to the eval() function from an about:blank window, a malicious webpage could have… | 6.5 | 0.0139 | | | [CVE-2020-15658](https://patchblox.com/security/data/cve/CVE-2020-15658.md) | Routine | Firefox ESR and 2 others: The code for downloading files did not properly take care of special characters, which led to an attacker… | 6.5 | 0.0139 | | | [CVE-2020-26958](https://patchblox.com/security/data/cve/CVE-2020-26958.md) | Routine | Firefox ESR and 2 others: Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted… | 6.1 | 0.0136 | | | [CVE-2020-26966](https://patchblox.com/security/data/cve/CVE-2020-26966.md) | Routine | Firefox ESR and 2 others: Searching for a single word from the address bar caused an mDNS request to be sent on the local network… | 6.5 | 0.0135 | | | [CVE-2020-26978](https://patchblox.com/security/data/cve/CVE-2020-26978.md) | Routine | Firefox ESR and 2 others: Using techniques that built on the slipstream research, a malicious webpage could have exposed both an… | 6.1 | 0.0133 | | | [CVE-2020-26953](https://patchblox.com/security/data/cve/CVE-2020-26953.md) | Routine | Firefox ESR and 2 others: It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus… | 4.3 | 0.0129 | | | [CVE-2020-15652](https://patchblox.com/security/data/cve/CVE-2020-15652.md) | Routine | Firefox ESR and 2 others: By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result… | 6.5 | 0.0126 | | | [CVE-2020-26965](https://patchblox.com/security/data/cve/CVE-2020-26965.md) | Routine | Firefox ESR and 2 others: Some websites have a feature "Show Password" where clicking a button will change a password field into… | 6.5 | 0.0126 | | | [CVE-2020-15666](https://patchblox.com/security/data/cve/CVE-2020-15666.md) | Routine | Firefox ESR and 1 other: When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500,… | 6.5 | 0.0124 | | | [CVE-2020-26956](https://patchblox.com/security/data/cve/CVE-2020-26956.md) | Routine | Firefox ESR and 2 others: In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and… | 6.1 | 0.0123 | | | [CVE-2021-29945](https://patchblox.com/security/data/cve/CVE-2021-29945.md) | Routine | Firefox ESR and 2 others: The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and… | 6.5 | 0.0120 | | | [CVE-2020-26961](https://patchblox.com/security/data/cve/CVE-2020-26961.md) | Routine | Firefox ESR and 2 others: When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses… | 6.5 | 0.0117 | | | [CVE-2021-29982](https://patchblox.com/security/data/cve/CVE-2021-29982.md) | Routine | Firefox ESR and 3 others: Due to incorrect JIT optimization, we incorrectly interpreted data from the wrong type of object, resulting… | 6.5 | 0.0112 | | | [CVE-2021-23984](https://patchblox.com/security/data/cve/CVE-2021-23984.md) | Routine | Firefox ESR and 2 others: A malicious extension could have opened a popup window lacking an address bar. | 6.5 | 0.0111 | | | [CVE-2021-23953](https://patchblox.com/security/data/cve/CVE-2021-23953.md) | Routine | Firefox ESR and 2 others: If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin… | 4.3 | 0.0106 | | | [CVE-2020-26951](https://patchblox.com/security/data/cve/CVE-2020-26951.md) | Routine | Firefox ESR and 2 others: A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even… | 6.1 | 0.0105 | | | [CVE-2021-23975](https://patchblox.com/security/data/cve/CVE-2021-23975.md) | Routine | Firefox ESR and 1 other: The developer page about:memory has a Measure function for exploring what object types the browser has… | 6.5 | 0.0101 | | | [CVE-2021-23970](https://patchblox.com/security/data/cve/CVE-2021-23970.md) | Routine | Firefox ESR and 1 other: Context-specific code was included in a shared jump table; resulting in assertions being triggered in… | 6.5 | 0.0101 | | | [CVE-2021-23971](https://patchblox.com/security/data/cve/CVE-2021-23971.md) | Routine | Firefox ESR and 1 other: When processing a redirect with a conflicting Referrer-Policy, Firefox would have adopted the redirect's… | 6.5 | 0.0101 | | | [CVE-2021-23956](https://patchblox.com/security/data/cve/CVE-2021-23956.md) | Routine | Firefox ESR and 1 other: An ambiguous file picker design could have confused users who intended to select and upload a single… | 6.5 | 0.0099 | | | [CVE-2021-29975](https://patchblox.com/security/data/cve/CVE-2021-29975.md) | Routine | Firefox ESR and 1 other: Through a series of DOM manipulations, a message, over which the attacker had control of the text but… | 6.5 | 0.0096 | | | [CVE-2020-15680](https://patchblox.com/security/data/cve/CVE-2020-15680.md) | Routine | Firefox ESR and 1 other: If a valid external protocol handler was referenced in an image tag, the resulting broken image size… | 5.3 | 0.0095 | | | [CVE-2021-23958](https://patchblox.com/security/data/cve/CVE-2021-23958.md) | Routine | Firefox ESR and 1 other: The browser could have been confused into transferring a screen sharing state into another tab, which… | 6.5 | 0.0088 | | | [CVE-2020-26975](https://patchblox.com/security/data/cve/CVE-2020-26975.md) | Routine | Firefox ESR and 1 other: When a malicious application installed on the user's device broadcast an Intent to Firefox for Android,… | 6.5 | 0.0088 | | | [CVE-2020-26977](https://patchblox.com/security/data/cve/CVE-2020-26977.md) | Routine | Firefox ESR and 1 other: By attempting to connect a website using an unresponsive port, an attacker could have controlled the… | 6.5 | 0.0087 | | | [CVE-2020-26967](https://patchblox.com/security/data/cve/CVE-2020-26967.md) | Routine | Firefox ESR and 1 other: When listening for page changes with a Mutation Observer, a malicious web page could confuse Firefox… | 6.5 | 0.0085 | | | [CVE-2020-26963](https://patchblox.com/security/data/cve/CVE-2020-26963.md) | Routine | Firefox ESR and 1 other: Repeated calls to the history and location interfaces could have been used to hang the browser. | 4.3 | 0.0085 | | | [CVE-2021-29974](https://patchblox.com/security/data/cve/CVE-2021-29974.md) | Routine | Firefox ESR and 1 other: When network partitioning was enabled, e.g. | 4.3 | 0.0084 | | | [CVE-2021-29959](https://patchblox.com/security/data/cve/CVE-2021-29959.md) | Routine | Mozilla Firefox ESR: When a user has already allowed a website to access microphone and camera, disabling camera sharing would… | 4.3 | 0.0084 | | | [CVE-2020-26955](https://patchblox.com/security/data/cve/CVE-2020-26955.md) | Routine | Firefox ESR and 1 other: When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent… | 6.5 | 0.0083 | | | [CVE-2021-29960](https://patchblox.com/security/data/cve/CVE-2021-29960.md) | Routine | Mozilla Firefox ESR: Firefox used to cache the last filename used for printing a file. | 4.3 | 0.0083 | | | [CVE-2021-29961](https://patchblox.com/security/data/cve/CVE-2021-29961.md) | Routine | Mozilla Firefox ESR: When styling and rendering an oversized `