Threats tagged 'ghsa-mjcw-r3mg-3848'

A vulnerability in Firefox and Thunderbird's Enhanced Tracking Protection Strict mode allowed a Content Security Policy (CSP) frame-src bypass and DOM-based cross-site scripting (XSS) via the Google SafeFrame shim in the Web Compatibility extension. This flaw could have enabled malicious frames to appear as legitimate content, potentially exposing users to harmful scripts. The issue affects Firefox versions prior to 133, Firefox ESR versions prior to 128.5 and 115.18, and Thunderbird versions prior to 133 and 128.5. The vulnerability has been addressed in Firefox 133 and corresponding ESR and Thunderbird releases.