Description
When typing in a password under certain conditions, a race may have occured where the InputContext was not being correctly set for the input field, resulting in the typed password being saved to the keyboard dictionary. This vulnerability affects Firefox for Android < 80.
Affected products
mozilla: firefox mobile
References4
- bugzilla.mozilla.org/show_bug.cgi?id=1653862 Issue TrackingPermissions RequiredVendor Advisory
- www.mozilla.org/security/advisories/mfsa2020-39/ Release NotesVendor Advisory
- bugzilla.mozilla.org/show_bug.cgi?id=1653862 Issue TrackingPermissions RequiredVendor Advisory
- www.mozilla.org/security/advisories/mfsa2020-39/ Release NotesVendor Advisory
Metrics
- CVSS 3.1
-
3.1
LOW
Score source: NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N - EPSS — exploit probability
- 0% percentile: 43 · as of 11 November 2026
- CWE
- CWE-200CWE-362
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.