Skip to content
Fencer Intel
medium 4.3

CVE-2021-23963 json

When sharing geolocation during an active WebRTC share, Firefox could have reset the webRTC sharing state in the user interface, leading to…

published 5y ago modified 4mo ago also EUVD-2021-10884

cvss
4.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 51%
public exploits
0
none known

Summary

When sharing geolocation during an active WebRTC share, Firefox could have reset the webRTC sharing state in the user interface, leading to loss of control over the currently granted permission. This vulnerability affects Firefox < 85.

Patch / fix

  • mozilla firefox 85.0
  • firefox Ubuntu 16.04 LTS 85.0+build1-0ubuntu0.16.04.1
  • firefox Ubuntu 18.04 LTS 85.0+build1-0ubuntu0.18.04.1
  • firefox Ubuntu 20.04 LTS 85.0+build1-0ubuntu0.20.04.1

ubuntu advisories UBUNTU-CVE-2021-23963

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • firefox-esr openSUSE Tumbleweed 128.5.1-1.1
  • MozillaFirefox openSUSE Tumbleweed 92.0-1.2

opensuse advisories openSUSE-SU-2024:14572-1openSUSE-SU-2024:10600-1

  • firefox Alpine 3.23, Alpine 3.22, Alpine 3.21 +8 more 85.0-r0
  • librewolf Alpine 3.24, Alpine 3.23, Alpine 3.22 +1 more 85.0-r0

alpine advisories ALPINE-CVE-2021-23963

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • firefox Arch Linux 85.0-1

arch linux advisories AVG-1492

Is CVE-2021-23963 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

0.66% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

  • Mozilla Firefox

Classification

Weakness
  • CWE-281 Improper Preservation of Permissions

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.