Medium severity6.5NVD Advisory· Published Aug 10, 2020· Updated Jun 17, 2026
CVE-2020-15653
CVE-2020-15653
Description
An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. This could have led to security issues for websites relying on sandbox configurations that allowed popups and hosted arbitrary content. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
39cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*range: <79.0
- cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*range: <78.1
- (no CPE)range: <78.1
- (no CPE)range: unspecified
- (no CPE)range: unspecified
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*range: <78.1
- (no CPE)range: <78.1
- (no CPE)range: unspecified
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*+ 2 more
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
- osv-coords28 versionspkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Leap%2015.1pkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/firefox-esr&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/pipewire&distro=openSUSE%20Leap%2015.2pkg:rpm/suse/MozillaFirefox&distro=HPE%20Helion%20OpenStack%208pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Enterprise%20Storage%205pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP1pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP2pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCLpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCLpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5pkg:rpm/suse/MozillaFirefox&distro=SUSE%20OpenStack%20Cloud%207pkg:rpm/suse/MozillaFirefox&distro=SUSE%20OpenStack%20Cloud%208pkg:rpm/suse/MozillaFirefox&distro=SUSE%20OpenStack%20Cloud%209pkg:rpm/suse/MozillaFirefox&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208pkg:rpm/suse/MozillaFirefox&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP2pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP2
< 78.1.0-lp151.2.61.1+ 27 more
- (no CPE)range: < 78.1.0-lp151.2.61.1
- (no CPE)range: < 78.1.0-lp152.2.12.1
- (no CPE)range: < 92.0-1.2
- (no CPE)range: < 128.5.1-1.1
- (no CPE)range: < 0.3.6-lp152.2.3.1
- (no CPE)range: < 78.1.0-112.8.1
- (no CPE)range: < 78.1.0-112.8.1
- (no CPE)range: < 78.1.0-3.100.2
- (no CPE)range: < 78.1.0-8.3.1
- (no CPE)range: < 78.1.0-78.87.1
- (no CPE)range: < 78.1.0-112.8.1
- (no CPE)range: < 78.1.0-112.8.1
- (no CPE)range: < 78.1.0-112.8.1
- (no CPE)range: < 78.1.0-112.8.1
- (no CPE)range: < 78.1.0-112.8.1
- (no CPE)range: < 78.1.0-112.8.1
- (no CPE)range: < 78.1.0-112.8.1
- (no CPE)range: < 78.1.0-112.8.1
- (no CPE)range: < 78.1.0-112.8.1
- (no CPE)range: < 78.1.0-112.8.1
- (no CPE)range: < 78.1.0-112.8.1
- (no CPE)range: < 78.1.0-112.8.1
- (no CPE)range: < 78.1.0-112.8.1
- (no CPE)range: < 78.1.0-112.8.1
- (no CPE)range: < 78.1.0-112.8.1
- (no CPE)range: < 78.1.0-112.8.1
- (no CPE)range: < 78-9.2.4
- (no CPE)range: < 0.3.6-3.3.2
Patches
Vulnerability mechanics
References
6- lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.htmlnvdThird Party Advisory
- bugzilla.mozilla.org/show_bug.cginvdIssue TrackingPermissions RequiredVendor Advisory
- usn.ubuntu.com/4443-1/nvdThird Party Advisory
- www.mozilla.org/security/advisories/mfsa2020-30/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2020-32/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2020-33/nvdVendor Advisory
News mentions
0No linked articles in our index yet.