description: Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it was used in the Web Extension's Content Security Policy. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
problem types: frame-ancestors Content Security Policy directive was not enforced for framed extension pages
affected:
{
vendor: Mozilla
product: Firefox
versions:
version: unspecified, lessThan: 97, status: affected, versionType: custom
}
{
vendor: Mozilla
product: Thunderbird
versions:
version: unspecified, lessThan: 91.6, status: affected, versionType: custom
}
{
vendor: Mozilla
product: Firefox ESR
versions:
version: unspecified, lessThan: 91.6, status: affected, versionType: custom
}
