CVE-2020-15649: 
Mozilla Firefox ESR vulnerability analysis and mitigation

CVE-2020-15649 is a security vulnerability discovered in Mozilla Firefox for Android that was disclosed on July 28, 2020. The vulnerability affects Firefox ESR versions prior to 68.11, allowing malicious file picker applications to exfiltrate local files (Mozilla Advisory).

The vulnerability is rated as moderate severity with a CVSS score of 3.07. The issue stems from insufficient validation in the GET_CONTENT activity result, which could lead to sensitive file exposure. When exploited, a malicious file picker application could steal and upload local files of their choosing, regardless of the actual files selected by the user (Mozilla Advisory, ManageEngine).

The vulnerability allows attackers with a malicious file picker application to steal and exfiltrate local files from the affected Android device. This could lead to unauthorized access to sensitive user data stored on the device. The issue specifically affects Firefox for Android, while other operating systems remain unaffected (Mozilla Advisory).

The vulnerability requires the presence of a malicious file picker application on the affected device. Once such an application is installed, it can be leveraged to steal local files through Firefox's file picking functionality (Mozilla Advisory).

The vulnerability was addressed in Firefox ESR version 68.11. Users should update their Firefox for Android installations to this version or later to protect against this security issue (Mozilla Advisory).