CVE-2021-38503
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 3.8%
exploitation probability
3.8%top 10% of all CVEs
observed exploitation
nono source reports it
The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or navigating the top-level frame. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.
References
https://bugzilla.mozilla.org/show_bug.cgi?id=1729517https://lists.debian.org/debian-lts-announce/2021/12/msg00030.htmlhttps://lists.debian.org/debian-lts-announce/2022/01/msg00001.htmlhttps://security.gentoo.org/glsa/202202-03https://security.gentoo.org/glsa/202208-14https://www.debian.org/security/2021/dsa-5026https://www.debian.org/security/2022/dsa-5034https://www.mozilla.org/security/advisories/mfsa2021-48/https://www.mozilla.org/security/advisories/mfsa2021-49/https://www.mozilla.org/security/advisories/mfsa2021-50/