## mfsa2021-20.yml
announced: May 5, 2021
impact: critical
fixed_in:
- Firefox 88.0.1
- Firefox for Android 88.1.3
title: Security Vulnerabilities fixed in Firefox 88.0.1, Firefox for Android 88.1.3
advisories:
  CVE-2021-29953:
    title: Universal Cross-Site Scripting
    impact: critical
    reporter: Wladimir Palant working with Include Security
    description: |
      A malicious webpage could have forced a Firefox for Android user into executing attacker-controlled JavaScript in the context of another domain, resulting in a Universal Cross-Site Scripting vulnerability.<br>*Note: This issue only affected Firefox for Android. Other operating systems are unaffected. Further details are being temporarily withheld to allow users an opportunity to update.*
    bugs:
      - url: 1701684
  CVE-2021-29952:
    title: Race condition in Web Render Components
    impact: high
    reporter: Tyson Smith
    description: |
      When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort may have been exploitable to run arbitrary code.
    bugs:
      - url: 1704227

## mfsa2021-20.yml
announced: May 5, 2021
impact: critical
fixed_in:
- Firefox 88.0.1
- Firefox for Android 88.1.3
title: Security Vulnerabilities fixed in Firefox 88.0.1, Firefox for Android 88.1.3
advisories:
  CVE-2021-29953:
    title: Universal Cross-Site Scripting via pop-up prompts
    impact: critical
    reporter: Wladimir Palant working with Include Security
    description: |
      By triggering multiple pop-up prompts containing <code>javascript:</code> URLs, a malicious webpage could have forced a Firefox for Android user into executing attacker-controlled JavaScript in the context of another domain, resulting in a Universal Cross-Site Scripting vulnerability.<br>*Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*
    bugs:
      - url: 1701684
  CVE-2021-29952:
    title: Race condition in Web Render Components
    impact: high
    reporter: Tyson Smith
    description: |
      When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort may have been exploitable to run arbitrary code.
    bugs:
      - url: 1704227

Add more details about the Fenix UXSS
Add more details about the Fenix UXSS
