Security readout for executives and security teams
Plain-English summary
Firefox for Android could incorrectly share a saved website permission across the same host, even when the page used a different scheme or port. This could let another page on that host receive permissions the user only intended for a different page. Other operating systems are listed as unaffected.
Executive priority
Treat as a focused mobile browser privacy and permission-risk issue. It is not broadly platform-wide, but outdated Firefox for Android should be remediated through normal endpoint hygiene.
Technical view
CVE-2021-29971 is a Firefox for Android permission scoping flaw affecting Firefox versions before 90. Saved permission grants were keyed too broadly by host, ignoring scheme and port. The supplied sources do not provide CVSS, CWE, or evidence of exploitation.
Likely exposure
Exposure is limited to Firefox for Android installations older than version 90 where users saved site permissions. Desktop Firefox and other operating systems are explicitly listed as unaffected in the CVE description.
Exploitation context
The supplied sources do not indicate active exploitation, and the CVE is not marked KEV. Practical abuse would require a previously saved permission grant and another webpage running on the same host.
Researcher notes
Key facts are clear: Firefox for Android only, Firefox before 90, host-level permission scoping issue. Evidence is incomplete for severity scoring, CWE classification, exploitation, and any mitigations beyond moving off affected versions.
Mitigation direction
- Upgrade Firefox for Android to version 90 or later.
- Review and revoke unnecessary saved site permissions.
- Check Mozilla advisory guidance for any environment-specific direction.
- Prioritize managed Android devices running outdated Firefox builds.
Validation and detection
- Inventory Android devices with Firefox installed.
- Confirm Firefox for Android version is 90 or later.
- Review saved site permissions for sensitive grants.
- Verify no non-Android Firefox deployments are incorrectly flagged.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-29971 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.mozilla.org/security/advisories/mfsa2021-28/CVE reference · x_refsource_MISC
- https://bugzilla.mozilla.org/show_bug.cgi?id=1713638CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.