Not rated
CVE-2020-35112 If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there…
Description
If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there was an executable file in the downloads directory with the same name but with an executable extension (such as .bat or .exe) that executable would have been launched instead. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Firefox 84 | earliest → < 84 | 84 |
| Thunderbird 78.6 | earliest → < 78.6 | 78.6 |
| Firefox ESR 78.6 | earliest → < 78.6 | 78.6 |
Other CVEs of Firefox
The 2221 CVEs of Firefox →
CVE-2026-120572
Incorrect boundary conditions in the Layout: Block and Inline component
8.8
High
CVE-2026-118027
Frame poisoning in the Layout component
9.1
Critical
CVE-2026-118026
Invalid pointer in the JavaScript: GC component
8.8
High
CVE-2026-118024
Use-after-free in the Graphics: Text component
8.8
High