CVE-2020-15648: Mozilla Firefox

Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days.

Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header. This vulnerability affects Thunderbird < 78 and Firefox < 78.0.2.

Affected products

• Mozilla Firefox: before 78.0.2 (fixed in 78.0.2)
• Mozilla Thunderbird: before 78.0 (fixed in 78.0)

Published 2020-08-10. Last modified 2026-06-17.