CVE-2020-26957Medium· 6.5▾ SunlitOneCRL was non-functional in the new Firefox for Android due to a missing service initialization. This could result in a failure to enforce some certificate revocations. *Note: This issue only affected Firefox for Android. Other operatin…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.5%
0.5% → 0.6%
OneCRL was non-functional in the new Firefox for Android due to a missing service initialization. This could result in a failure to enforce some certificate revocations. Note: This issue only affected Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox < 83.
firefox_mobile < 83.0Upgrade past the affected range:
firefox_mobile 83.0Connected by shared product, vendor, weakness, or advisory.
CVE-2020-26964Medium· 6.8If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6.0, untrusted apps could have connected to the feature and operated with the privileges of the browser to read and interac…
CVE-2020-26955Medium· 6.5When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent during a subsequent file download operation on the same domain, regardless of whether the original and subsequent request were in privat…
CVE-2020-26954Medium· 4.3When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins
CVE-2026-100823Medium· 5.4Spoofing issue in the Downloads component in Firefox for Android
CVE-2026-92033High· 8.8Privilege escalation in Firefox for Android
CVE-2026-86853Medium· 4.3A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches