Medium severity4.3NVD Advisory· Published Dec 8, 2021· Updated Jun 17, 2026
CVE-2021-38506
CVE-2021-38506
Description
Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user. This could lead to spoofing attacks on the browser UI including phishing. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
47unspecified+ 4 more
- (no CPE)range: unspecified
- (no CPE)range: unspecified
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*range: <94.0
- cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*range: <91.3.0
- (no CPE)range: <94
unspecified+ 2 more
- (no CPE)range: unspecified
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*range: <91.3.0
- (no CPE)range: <91.3
- osv-coords36 versionspkg:rpm/opensuse/firefox-esr&distro=openSUSE%20Tumbleweedpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCLpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCLpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP3pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP2pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Tumbleweedpkg:rpm/almalinux/firefoxpkg:rpm/almalinux/thunderbirdpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP2pkg:rpm/suse/MozillaFirefox&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCLpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Enterprise%20Storage%206pkg:rpm/suse/MozillaFirefox&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSSpkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Leap%2015.2pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP3pkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Leap%2015.3pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Leap%2015.3pkg:rpm/suse/MozillaFirefox&distro=HPE%20Helion%20OpenStack%208pkg:rpm/suse/MozillaFirefox&distro=SUSE%20OpenStack%20Cloud%208pkg:rpm/suse/MozillaFirefox&distro=SUSE%20OpenStack%20Cloud%209pkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Tumbleweed
< 128.5.1-1.1+ 35 more
- (no CPE)range: < 128.5.1-1.1
- (no CPE)range: < 91.3.0-150.6.1
- (no CPE)range: < 91.3.0-150.6.1
- (no CPE)range: < 91.3.0-150.6.1
- (no CPE)range: < 91.3.0-150.6.1
- (no CPE)range: < 91.3.0-150.6.1
- (no CPE)range: < 91.3.0-150.6.1
- (no CPE)range: < 91.3.0-112.80.2
- (no CPE)range: < 91.3.0-112.80.2
- (no CPE)range: < 91.3.0-112.80.2
- (no CPE)range: < 91.3.0-112.80.2
- (no CPE)range: < 91.3.0-112.80.2
- (no CPE)range: < 91.3.0-112.80.2
- (no CPE)range: < 91.3.0-112.80.2
- (no CPE)range: < 91.3.0-152.6.1
- (no CPE)range: < 91.4.0-8.45.2
- (no CPE)range: < 91.3.0-1.1
- (no CPE)range: < 91.3.0-1.el8_4.alma
- (no CPE)range: < 91.3.0-2.el8_4.alma
- (no CPE)range: < 91.3.0-112.80.2
- (no CPE)range: < 91.3.0-152.6.1
- (no CPE)range: < 91.3.0-112.80.2
- (no CPE)range: < 91.3.0-150.6.1
- (no CPE)range: < 91.3.0-150.6.1
- (no CPE)range: < 91.3.0-150.6.1
- (no CPE)range: < 91.3.0-150.6.1
- (no CPE)range: < 91.3.0-112.80.2
- (no CPE)range: < 91.3.0-112.80.2
- (no CPE)range: < 91.4.0-lp152.2.52.1
- (no CPE)range: < 91.4.0-8.45.2
- (no CPE)range: < 91.3.0-152.6.1
- (no CPE)range: < 91.4.0-8.45.2
- (no CPE)range: < 91.3.0-112.80.2
- (no CPE)range: < 91.3.0-112.80.2
- (no CPE)range: < 91.3.0-112.80.2
- (no CPE)range: < 94.0.1-1.1
Patches
Vulnerability mechanics
References
10- bugzilla.mozilla.org/show_bug.cginvdIssue TrackingPermissions RequiredVendor Advisory
- lists.debian.org/debian-lts-announce/2021/12/msg00030.htmlnvdMailing ListThird Party Advisory
- lists.debian.org/debian-lts-announce/2022/01/msg00001.htmlnvdMailing ListThird Party Advisory
- security.gentoo.org/glsa/202202-03nvdThird Party Advisory
- security.gentoo.org/glsa/202208-14nvdThird Party Advisory
- www.debian.org/security/2021/dsa-5026nvdThird Party Advisory
- www.debian.org/security/2022/dsa-5034nvdThird Party Advisory
- www.mozilla.org/security/advisories/mfsa2021-48/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2021-49/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2021-50/nvdVendor Advisory
News mentions
0No linked articles in our index yet.