CVE-2020-12424: Mozilla Firefox

Medium severity, CVSS 6.5. EPSS: 1.6% chance of exploitation in the next 30 days.

When constructing a permission prompt for WebRTC, a URI was supplied from the content process. This URI was untrusted, and could have been the URI of an origin that was previously granted permission; bypassing the prompt. This vulnerability affects Firefox < 78.

Affected products

• Mozilla Firefox: before 78.0 (fixed in 78.0)
• Opensuse Leap: version 15.1 only; version 15.2 only

Published 2020-07-09. Last modified 2026-06-17.