CVE-2022-22759

What it actually does

Sandbox attribute on iframes is bypassed allowing JavaScript event handlers on dynamically appended child elements to execute despite the absence of allow-scripts, violating the intended isolation boundary.

Why it matters to the business

Attackers can execute arbitrary scripts in contexts that should be isolated, increasing risk of credential theft, data exfiltration, or further compromise for any users on unpatched browsers; prevalence across the Mozilla ecosystem amplifies exposure for organizations relying on Firefox or Thunderbird.

How an attack unfolds

An attacker hosts a page containing a sandboxed iframe without allow-scripts, then appends an element carrying an event handler; when the victim visits the page the handler fires, granting script execution outside the sandbox.

How to fix it

Upgrade Mozilla Firefox to version 97 or later, Firefox ESR to 91.6 or later, and Thunderbird to 91.6 or later; apply updates immediately given the age of the vulnerability and high CVSS score.

How to confirm the fix worked

Verify installed browser and mail client versions against the fixed releases (Firefox >=97, ESR >=91.6, Thunderbird >=91.6); retest any internal web content that relies on sandboxed iframes after patching.

Typical attack path

1. Host a crafted page containing a sandboxed iframe lacking allow-scripts
2. Append an element with a JavaScript event handler to the iframe document
3. Trick a victim into loading the page in an affected browser
4. Execute attacker-controlled code that bypasses the sandbox restriction

How to detect it

Review web proxy or browser telemetry logs for unusual iframe creation patterns or script execution originating from sandboxed frames; correlate with known malicious pages if threat intelligence feeds exist.

What your security team should do

• Prioritize browser and email client updates across all endpoints within the next 7 days
• Audit web applications that embed third-party or user-supplied content inside sandboxed iframes
• Enable enterprise update policies and monitor for outdated Mozilla installations via inventory tools
• Review logging for any post-patch anomalies in iframe behavior as a sanity check