CVE-2020-12401
During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resultin
CVSS
4.7
Medio
EPSS
0.3%
p25
KEV
—
Exploit Today
8
0-100
Publicado: 8 oct 2020 · Última mod.: 19 ago 2026 · CWE-203
0.3%EPSS · 30 días0.3%
2026-08-172026-09-13
During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox < 80 and Firefox for Android < 80.
- bugzilla.mozilla.orghttps://bugzilla.mozilla.org/show_bug.cgi?id=1631573
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2023/02/msg00021.html
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2020-36/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2020-39/
- bugzilla.mozilla.orghttps://bugzilla.mozilla.org/show_bug.cgi?id=1631573
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2023/02/msg00021.html
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2020-36/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2020-39/
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-876236.5 MED14.8%
——4Observable discrepancy in DOM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)6dCVE-2026-876206.5 MED14.8%
——4Observable discrepancy in SVG in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)6dCVE-2026-876194.3 MED9.2%
——3Observable discrepancy in Prefetch in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)6dCVE-2026-875665.3 MED12.5%
——4Observable discrepancy in Layout in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)6dCVE-2026-875393.1 BAJ12.0%
——4Observable discrepancy in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)5dCVE-2026-875185.3 MED17.4%
——5Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)6d