CVE-2020-26976: Debian Linux

Medium severity, CVSS 6.5. EPSS: 1.6% chance of exploitation in the next 30 days.

When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former, the service worker could have intercepted the request for the secure page despite the iframe not being a secure context due to the (insecure) framing. This vulnerability affects Firefox < 84.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only
• Mozilla Firefox: before 84.0 (fixed in 84.0)

Published 2021-01-07. Last modified 2026-06-17.