CVE-2021-23974

MEDIUM

Firefox < 86.0 - Cross-Site Scripting via DOMParser Noscript Element Handling

Title source: llm
STIX 2.1

Description

The DOMParser API did not properly process '<noscript>' elements for escaping. This could be used as an mXSS vector to bypass an HTML Sanitizer. This vulnerability affects Firefox < 86.

References (3)

Core 3
Core References
Release Notes, Vendor Advisory x_refsource_misc
https://www.mozilla.org/security/advisories/mfsa2021-07/
Issue Tracking, Vendor Advisory x_refsource_misc
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1528997%2C1683627
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/202104-10

Scores

CVSS v3 6.1
EPSS 0.0019
EPSS Percentile 40.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

Status published
Products (1)
mozilla/firefox < 86.0
Published Feb 26, 2021
Tracked Since Feb 18, 2026