CVE-2021-23985: Mozilla Firefox

Medium severity, CVSS 6.5. EPSS: 1.5% chance of exploitation in the next 30 days.

If an attacker is able to alter specific about:config values (for example malware running on the user's computer), the Devtools remote debugging feature could have been enabled in a way that was unnoticable to the user. This would have allowed a remote attacker (able to make a direct network connection to the victim) to monitor the user's browsing activity and (plaintext) network traffic. This was addressed by providing a visual cue when Devtools has an open network socket. This vulnerability affects Firefox < 87.

Affected products

• Mozilla Firefox: before 87.0 (fixed in 87.0)

Published 2021-03-31. Last modified 2026-06-17.