CVE-2020-26954: 
NixOS vulnerability analysis and mitigation

CVE-2020-26954 is a security vulnerability discovered in Firefox for Android that affects versions prior to 83.0. The vulnerability was disclosed on November 17, 2020, and involves a flaw in how Firefox for Android handles web manifests from other installed applications (Mozilla Advisory, NVD).

The vulnerability occurs when Firefox for Android accepts manifests from arbitrary file paths and allows declaring webapp manifests for other origins through malicious intents from other installed applications. The issue received a CVSS v3.1 Base Score of 4.3 (MEDIUM) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (NVD).

This vulnerability could be exploited to gain fullscreen access for UI spoofing and could lead to cross-origin attacks on targeted websites. The impact is specifically limited to Firefox for Android users, as other operating systems are unaffected (Mozilla Advisory).

The vulnerability requires a malicious application to be installed on the device to exploit the flaw. The attacker can use the malicious app to inject arbitrary PWA manifest for any origin, which can be used for installing malicious PWAs on the victim's device silently (Bugzilla).

The vulnerability was fixed in Firefox for Android version 83.0. Users should update their Firefox for Android installation to version 83.0 or later to receive the security fix. The fix includes validation of manifest locations inside the app files before reading them (Mozilla Advisory).