description: An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. This could have led to security issues for websites relying on sandbox configurations that allowed popups and hosted arbitrary content. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.
problem types: Bypassing iframe sandbox when allowing popups
affected:
{
product: Firefox ESR
vendor: Mozilla
versions:
lessThan: 78.1, status: affected, version: unspecified, versionType: custom
}
{
product: Firefox
vendor: Mozilla
versions:
lessThan: 79, status: affected, version: unspecified, versionType: custom
}
{
product: Thunderbird
vendor: Mozilla
versions:
lessThan: 78.1, status: affected, version: unspecified, versionType: custom
}
