Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2021-43536: Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Fire...

CVE-2021-43536 · published 4 years ago

Summary

Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.

What to do

Update mozilla firefox to version 95.0 or later.
Update mozilla firefox_esr to version 91.4.0 or later.
Update mozilla thunderbird to version 91.4.0 or later.

Affected software

Vendor	Product	Affected versions
mozilla	firefox	< 95.0 `cpe:2.3:a:mozilla:firefox::::::::`
mozilla	firefox_esr	< 91.4.0 `cpe:2.3:a:mozilla:firefox_esr::::::::`
mozilla	thunderbird	< 91.4.0 `cpe:2.3:a:mozilla:thunderbird::::::::`
debian	debian_linux	9.0 10.0 11.0 `cpe:2.3:o:debian:debian_linux:9.0:::::::*`

Original advisory text

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1730120 Issue Tracking Permissions Required
https://lists.debian.org/debian-lts-announce/2021/12/msg00030.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/01/msg00001.html Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202202-03 Third Party Advisory
https://security.gentoo.org/glsa/202208-14 Third Party Advisory
https://www.debian.org/security/2021/dsa-5026 Third Party Advisory
https://www.debian.org/security/2022/dsa-5034 Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2021-52/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2021-53/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2021-54/ Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.5 Medium

Exploitation

2% chance of attack within 30 days

Type

CWE-200Information Exposure

Timeline

Published8 Dec 2021

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2021-43536 · NVD

Track software like this

Free during beta