description: A content security policy (CSP) "frame-ancestors" directive containing origins with paths allows for comparisons against those paths instead of the origin. This results in a cross-origin information leak of this path information. This vulnerability affects Firefox < 55.
problem types: CSP information leak with frame-ancestors containing paths
affected:
{
product: Firefox
vendor: Mozilla
versions:
lessThan: 55, status: affected, version: unspecified, versionType: custom
}