CVE-2020-26956: Mozilla Firefox

Medium severity, CVSS 6.1. EPSS: 1.2% chance of exploitation in the next 30 days.

In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.

Affected products

• Mozilla Firefox: before 83.0 (fixed in 83.0)
• Mozilla Firefox ESR: before 78.5 (fixed in 78.5)
• Mozilla Thunderbird: before 78.5 (fixed in 78.5)

Published 2020-12-09. Last modified 2026-06-17.