| Package | Affected versions | Patched versions |
|---|---|---|
| firefox | < 140.0 | 140.0 |
The exception page for the HTTPS-Only feature, displayed when a website is opened via HTTP, lacked an anti-clickjacking delay, potentially allowing an attacker to trick a user into granting an exception and loading a webpage over HTTP. This vulnerability was fixed in Firefox 140 and Thunderbird 140.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free