CVE-2021-4140

What it actually does

Specific XSLT markup bypasses iframe sandbox restrictions, allowing unauthorized cross-origin access or code execution outside intended isolation boundaries.

Why it matters to the business

Attackers can escape browser sandbox protections, increasing risk of data exposure or unauthorized actions on user systems; low EPSS and no KEV status indicate limited observed exploitation but upgrade urgency remains for affected browser users.

How an attack unfolds

An attacker crafts malicious XSLT content that exploits the sandbox bypass, embeds it in a webpage, and relies on a victim loading the page in an unpatched browser to escape isolation and perform actions with elevated privileges.

How to fix it

Upgrade Firefox to 96 or later, Firefox ESR to 91.5 or later, Thunderbird to 91.5 or later; for open-policy-agent/opa update to commit 25a597bc3f4985162e7f65f9c36599f4f8f55823.

How to confirm the fix worked

Confirm browser or OPA version meets or exceeds the listed fixed versions; test sandboxed iframe behavior with known XSLT test cases to verify isolation enforcement.

Typical attack path

1. Craft XSLT markup designed to bypass iframe sandbox
2. Host or inject the markup into a malicious webpage
3. Social-engineer victim into visiting the page with affected browser version
4. Sandbox escape grants access to broader browser context or system resources

How to detect it

Review web server or browser logs for unusual XSLT processing or iframe sandbox violations; correlate with ExploitAvailable maturity indicators but no specific threat actor activity noted.

What your security team should do

• Prioritize patching affected Mozilla products and OPA instances within standard change windows given 1385 days since publication
• Monitor EPSS trend for any acceleration beyond the current +1% over 30 days
• Review web content policies to restrict untrusted XSLT processing where possible