| Package | Affected versions | Patched versions |
|---|---|---|
| firefox | ≥ 116.0, < 128.5.0< 115.8.0< 133.0 | 128.5.0115.8.0133.0 |
| thunderbird | ≥ 116.0, < 128.5.0≥ 129.0, < 133.0< 115.18.0 | 128.5.0133.0115.18.0 |
Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS through the Google SafeFrame shim in the Web Compatibility extension. This issue could have exposed users to malicious frames masquerading as legitimate content. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Firefox ESR < 115.18, Thunderbird < 133, Thunderbird < 128.5, and Thunderbird < 115.18.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free