CVE-2020-26964
MediumCVSS 6.8Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
Vulnerability in Firefox for Android related to the Remote Debugging via USB feature, which was enabled on Android versions prior to 6.0. Untrusted apps could connect to the feature and operate with browser privileges to read and interact with web content.
Risk Assessment
On devices with Android older than 6.0, untrusted apps could access and manipulate web content viewed in Firefox, posing a risk to privacy and data integrity.
Recommendation
Update Firefox for Android to version 83 or later, which removes this feature from affected devices.
Other vulnerabilities in Firefox for Android
See all- CVE-2023-29534Critical
In Firefox and Focus for Android, techniques were discovered to obscure the fullscreen notification, which could lead to user confusion and spoofing attacks. This affects Firefox for Android and Focus for Android versions prior to 112.
- CVE-2026-100823Medium
Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 157.
- CVE-2026-92033High
Privilege escalation vulnerability in Firefox for Android. Fixed in Firefox 156.
- CVE-2026-84117High
Privilege escalation in Firefox for Android. Fixed in Firefox 155.
- CVE-2026-74975Medium
A spoofing issue exists in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.
- CVE-2026-18809Medium
Information disclosure in Firefox for Android and Firefox Focus for Android. This vulnerability was fixed in Firefox 153.0.3.
- CVE-2026-16397Medium
Clickjacking vulnerability in the WebExtensions component in Firefox for Android. This issue was fixed in Firefox 153.
- CVE-2026-16373High
Vulnerability in the Privacy component in Firefox for Android. The flaw leads to information disclosure. The issue was fixed in Firefox 153.
- CVE-2025-8041Medium
In Firefox for Android, the address bar truncated the display of URLs from the end instead of prioritizing the origin. This vulnerability was fixed in Firefox 141.
- CVE-2025-6431Medium
When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so. An attacker could have bypassed this prompt, potentially exposing the user to security vulnerabilities or privacy leaks in external applications. This bug only affects Firefox for Android. Other versions of Firefox are unaffected. This vulnerability was fixed in Firefox 140.
Original NVD description (English source)
If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6.0, untrusted apps could have connected to the feature and operated with the privileges of the browser to read and interact with web content. The feature was implemented as a unix domain socket, protected by the Android SELinux policy; however, SELinux was not enforced for versions prior to 6.0. This was fixed by removing the Remote Debugging via USB feature from affected devices. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS