Cloudanix VulnDB

CVE-2021-43531

Medium · 4.3

CVSS

4.3

EPSS

0.3%

Published

Dec 8, 2021

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A browser extension could learn the final web address a user ended up on after a redirect when they right-clicked something, even though the extension was not supposed to see that address.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Data Exposure
Component
Application
Class
Information Disclosure
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

A Web Extension without WebRequest permission can obtain the post-redirect URL of a clicked context-menu target, violating same-origin boundaries that should restrict it to the pre-redirect location.

Why it matters to the business

Organizations relying on Firefox extensions for browsing or internal tools face a risk of unintended URL data exposure to those extensions, which could affect privacy controls or leak redirect targets in workflows that involve redirects.

How an attack unfolds

An attacker publishes or installs a malicious Web Extension that registers a context-menu listener; when a user right-clicks an element whose navigation triggers a redirect, the extension receives the final URL even without the required host permissions, allowing data capture.

How to fix it

Upgrade all Firefox installations to version 94 or later; audit installed extensions for unnecessary permissions and remove any that appear suspicious or unmaintained.

How to confirm the fix worked

Confirm the installed Firefox version is 94 or newer; review extension manifest permissions for contextMenus usage and test that context-menu handlers no longer receive post-redirect URLs.

Typical attack path

  1. Develop and distribute a Web Extension that requests contextMenus permission but omits WebRequest permission for target hosts.
  2. User installs the extension and navigates to a page containing a link or element that performs an HTTP redirect.
  3. User opens the context menu on the element, triggering the extension's listener.
  4. Extension receives and exfiltrates the post-redirect URL to attacker-controlled infrastructure.

How to detect it

Review Firefox extension installation and permission change events in browser telemetry or enterprise management logs; look for extensions that register context menu listeners and examine their network activity for unexpected outbound connections containing URL data.

What your security team should do

  • Prioritize browser updates across the fleet given the long publication window and low but non-zero EPSS.
  • Inventory and restrict Web Extensions that declare contextMenus without corresponding WebRequest scopes.
  • Monitor extension installation logs for additions from untrusted sources.

The record

When a user loaded a Web Extensions context menu, the Web Extension could access the post-redirect URL of the element clicked. If the Web Extension lacked the WebRequest permission for the hosts involved in the redirect, this would be a same-origin-violation leaking data the Web Extension should have access to. This was fixed to provide the pre-redirect URL. This is related to CVE-2021-43532 but in the context of Web Extensions. This vulnerability affects Firefox < 94.

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:18.04:LTS firefox 0 94.0+build3-0ubuntu0.18.04.1
Ubuntu:20.04:LTS firefox 0 94.0+build3-0ubuntu0.20.04.1
Ubuntu:22.04:LTS firefox 0 94.0+build3-0ubuntu1

Related vulnerabilities