The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from     arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain     fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. Note:
    This issue is a different issue from CVE-2020-26954 and only affected Firefox for Android. Other operating     systems are unaffected. This vulnerability affects Firefox < 86. (CVE-2021-23976)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Firefox installed on the remote Windows host is prior to 86.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-07 advisory.

  - Mozilla developers Tyson Smith, Lars T Hansen, Valentin Gosu, and Sebastian Hengst reported memory safety     bugs present in Firefox 85. Some of these bugs showed evidence of memory corruption and we presume that     with enough effort some of these could have been exploited to run arbitrary code. (CVE-2021-23979)

  - As specified in the W3C Content Security Policy draft, when creating a violation report, User agents need     to ensure that the source file is the URL requested by the page, pre-redirects. If thats not possible,     user agents need to strip the URL down to an origin to avoid unintentional leakage. Under certain types     of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was     fixed to be the redirect destination's origin. (CVE-2021-23969)

  - Context-specific code was included in a shared jump table; resulting in assertions being triggered in     multithreaded wasm code. (CVE-2021-23970)

  - If Content Security Policy blocked frame navigation, the full destination of a redirect served in the     frame was reported in the violation report; as opposed to the original frame URI. This could be used to     leak sensitive information contained in such URIs. (CVE-2021-23968)

  - The DOMParser API did not properly process <code><noscript></code> elements for escaping. This could     be used as an mXSS vector to bypass an HTML Sanitizer. (CVE-2021-23974)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202104-10 (Mozilla Firefox: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox. Please       review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 86.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-07 advisory.

  - Mozilla developers Tyson Smith, Lars T Hansen, Valentin Gosu, and Sebastian Hengst reported memory safety     bugs present in Firefox 85. Some of these bugs showed evidence of memory corruption and we presume that     with enough effort some of these could have been exploited to run arbitrary code. (CVE-2021-23979)

  - As specified in the W3C Content Security Policy draft, when creating a violation report, User agents need     to ensure that the source file is the URL requested by the page, pre-redirects. If thats not possible,     user agents need to strip the URL down to an origin to avoid unintentional leakage. Under certain types     of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was     fixed to be the redirect destination's origin. (CVE-2021-23969)

  - Context-specific code was included in a shared jump table; resulting in assertions being triggered in     multithreaded wasm code. (CVE-2021-23970)

  - If Content Security Policy blocked frame navigation, the full destination of a redirect served in the     frame was reported in the violation report; as opposed to the original frame URI. This could be used to     leak sensitive information contained in such URIs. (CVE-2021-23968)

  - The DOMParser API did not properly process <code><noscript></code> elements for escaping. This could     be used as an mXSS vector to bypass an HTML Sanitizer. (CVE-2021-23974)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
247761	Linux Distros Unpatched Vulnerability : CVE-2021-23976	Nessus	Misc.	8/10/2025	8/10/2025	high
146780	Mozilla Firefox < 86.0	Nessus	Windows	2/23/2021	11/18/2025	high
149233	GLSA-202104-10 : Mozilla Firefox: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	5/3/2021	1/12/2024	high
146779	Mozilla Firefox < 86.0	Nessus	MacOS X Local Security Checks	2/23/2021	11/18/2025	high

Detections

Analytics

Plugins Search

high

high

high

high