CVE-2021-23968

What it actually does

The flaw causes the full destination URI of a blocked frame navigation redirect to be included in Content Security Policy violation reports instead of the original frame URI, exposing sensitive data that may be present in the redirect target.

Why it matters to the business

Attackers may obtain sensitive information contained in URIs that should remain private, increasing risk of data exposure and follow-on attacks; the issue affects widely deployed browser products with high ecosystem reach.

How an attack unfolds

An attacker crafts a page that loads a frame subject to a restrictive CSP, forces a navigation that triggers a redirect to a sensitive URI, and then receives the violation report which leaks the full redirect destination; no named threat actors are associated with this CVE.

How to fix it

Upgrade Mozilla Firefox to version 86 or later, Firefox ESR to 78.8 or later, and Thunderbird to 78.8 or later; apply equivalent updates through distribution package managers such as Debian.

How to confirm the fix worked

Confirm deployed browser versions meet or exceed the fixed releases; generate test CSP violation reports for blocked frame redirects and verify that only the original frame URI appears.

Typical attack path

1. Serve a page containing an iframe subject to CSP frame navigation restrictions
2. Trigger a redirect inside the frame to a URI containing sensitive parameters or paths
3. Cause the CSP policy to block the navigation
4. Capture the resulting violation report containing the full redirect destination

How to detect it

Inspect CSP violation report logs for entries that contain unexpected full redirect URIs rather than original frame sources; correlate with web server access logs showing frame navigation attempts to sensitive endpoints.

What your security team should do

• Prioritize browser updates across all endpoints given the 2021 publication date and continued EPSS presence
• Audit Content Security Policy configurations to ensure they do not inadvertently expose redirect targets
• Review application code that relies on URI confidentiality within frames