Threats tagged 'ghsa-v4qx-h7r5-6qc8'

CVE-2025-4083 is a critical process isolation vulnerability in Firefox and Thunderbird caused by improper handling of javascript: URIs in cross-origin frames. This flaw allows content to execute in the top-level document's process rather than the intended frame, potentially enabling a sandbox escape. The vulnerability affects Firefox versions prior to 138, Firefox ESR versions prior to 128.10, Thunderbird versions prior to 138, and Thunderbird ESR versions prior to 128.10. Mozilla has fixed this issue in Firefox 138 and Firefox ESR 128.10.