description: If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to the iframe's document that e.g. had a JavaScript event handler - the event handler would have run despite the iframe's sandbox. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
problem types: Sandboxed iframes could have executed script if the parent appended elements
affected:
{
vendor: Mozilla
product: Firefox
versions:
version: unspecified, lessThan: 97, status: affected, versionType: custom
}
{
vendor: Mozilla
product: Thunderbird
versions:
version: unspecified, lessThan: 91.6, status: affected, versionType: custom
}
{
vendor: Mozilla
product: Firefox ESR
versions:
version: unspecified, lessThan: 91.6, status: affected, versionType: custom
}
