CVE-2020-26964

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 83

Description The issue arises when the Remote Debugging via USB feature is enabled in Firefox for Android on Android versions prior to 6.0, allowing untrusted apps to connect and operate with browser privileges, thus enabling them to read and interact with web content. This is due to the lack of SELinux enforcement in Android versions prior to 6.0, despite the feature being protected by the Android SELinux policy as a unix domain socket.

Recommendations For Firefox versions prior to 83, the issue was fixed by removing the Remote Debugging via USB feature from affected devices. As a temporary workaround, consider disabling the Remote Debugging via USB feature until the issue is resolved. Restrict access to the unix domain socket to minimize the risk of exploitation.