CVE-2021-43543

What it actually does

The flaw permits documents subject to a CSP sandbox directive to bypass the sandbox's script execution restrictions through embedding of additional content, resulting in unintended script execution within the isolated context.

Why it matters to the business

Older browser and email client deployments remain exposed to script injection risks that could lead to unauthorized access to user data, session compromise, or phishing escalation, increasing operational and compliance exposure until upgrades are completed.

How an attack unfolds

An attacker hosts or delivers a page that applies a CSP sandbox directive, then includes specially crafted embedded content designed to escape the script restriction, causing the victim's browser to execute attacker-controlled scripts despite the sandbox policy.

How to fix it

Upgrade Firefox to version 95 or later, Firefox ESR to 91.4.0 or later, and Thunderbird to 91.4.0 or later. Apply the updates through the product's built-in updater or distribution package manager and verify the new version string.

How to confirm the fix worked

Inspect the about:support page or application version string on each endpoint to confirm the installed release meets or exceeds the fixed versions; retest any internal pages that previously relied on CSP sandbox to ensure script restrictions are enforced.

Typical attack path

1. Identify or create a target site or email that loads user-controlled content under CSP sandbox
2. Embed additional markup or resources that trigger the sandbox escape
3. Deliver the content to the victim via phishing, compromised site, or malicious attachment
4. Trigger rendering in an affected Mozilla product to execute scripts outside sandbox boundaries

How to detect it

Review browser console logs and CSP violation reports for unexpected script execution originating from sandboxed contexts; correlate with web proxy or email client logs showing access to pages that declare sandbox directives.

What your security team should do

• Prioritize immediate rollout of the fixed versions across all managed endpoints given the multi-year exposure window
• Audit CSP headers on internal and partner sites that use sandbox directives
• Enable browser update enforcement policies and monitor enterprise update compliance dashboards
• Review email rendering configurations in Thunderbird deployments for any custom sandbox usage