CVE-2020-12394
Mozilla: URL spoofing in location bar when unfocussed
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · May 5, 2020
Updated · January 8, 2026
Description
The Mozilla Foundation Security Advisory describes this flaw as:
A logic flaw in our location bar implementation could have allowed a local attacker to spoof the current location by selecting a different origin and removing focus from the input element.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 2.5CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
CWE-451 · User Interface (UI) Misrepresentation of Critical Information