CVE-2021-38492: Mozilla Firefox

Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days.

When delegating navigations to the operating system, Firefox would accept the `mk` scheme which might allow attackers to launch pages and execute scripts in Internet Explorer in unprivileged mode. *This bug only affects Firefox for Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 92, Thunderbird < 91.1, Thunderbird < 78.14, Firefox ESR < 78.14, and Firefox ESR < 91.1.

Affected products

• Mozilla Firefox: before 92.0 (fixed in 92.0); from 91.0, before 91.1 (fixed in 91.1)
• Mozilla Firefox ESR: before 78.14 (fixed in 78.14)
• Mozilla Thunderbird: before 78.14 (fixed in 78.14); from 91.0, before 91.1 (fixed in 91.1)

Published 2021-11-03. Last modified 2026-06-17.