CVE-2021-29962: 
NixOS vulnerability analysis and mitigation

Firefox for Android would become unstable and hard-to-recover when a website opened too many popups, affecting Firefox versions prior to 89. This vulnerability (CVE-2021-29962) was discovered by Wladimir Palant working with Include Security and was disclosed on June 1, 2021. The issue specifically affected only Firefox for Android, with other operating systems being unaffected (Mozilla Advisory).

The vulnerability was classified with a CVSS v3.1 Base Score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L. The issue stemmed from the lack of rate-limiting for popup windows, allowing websites to trigger an unlimited number of popup prompts that would stack on top of each other. This resulted in the entire Fenix UI becoming unreachable, preventing users from switching tabs or reloading the page (NVD).

When exploited, the vulnerability could cause a denial of service condition on Firefox for Android. Users would find the browser interface becoming unresponsive, with multiple popup prompts stacking and blocking access to the UI. Even terminating and restarting the process wouldn't resolve the issue as the malicious page would reload upon restart (Mozilla Bugzilla).

The vulnerability was relatively easy to exploit, requiring only a malicious webpage that continuously calls window.open(). Each call would result in a new popup prompt, with no limit to the number of prompts that could stack. The attack could be triggered by simply visiting a malicious webpage that implements this behavior (Mozilla Bugzilla).

The vulnerability was fixed in Firefox 89 with the implementation of improved prompt handling. The fix ensures that only one popup prompt is shown at a time and reuses the existing prompt abuse detector to allow users to disallow further popups from the current page (Mozilla Advisory).