description: If a user installed an extension of a particular type, the extension could have auto-updated itself and while doing so, bypass the prompt which grants the new version the new requested permissions. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
problem types: Extensions could have bypassed permission confirmation during update
affected:
{
vendor: Mozilla
product: Firefox
versions:
version: unspecified, lessThan: 97, status: affected, versionType: custom
}
{
vendor: Mozilla
product: Thunderbird
versions:
version: unspecified, lessThan: 91.6, status: affected, versionType: custom
}
{
vendor: Mozilla
product: Firefox ESR
versions:
version: unspecified, lessThan: 91.6, status: affected, versionType: custom
}
