CVE-2022-26384

What it actually does

Bypass of iframe sandbox restrictions when allow-popups is granted without allow-scripts, enabling crafted links to trigger JavaScript execution in the parent context.

Why it matters to the business

Potential unauthorized code execution in user browsers could expose sensitive data, enable session hijacking, or facilitate further attacks on internal systems, increasing breach risk for organizations relying on older browser versions.

How an attack unfolds

An attacker hosts or injects content into a sandboxed iframe with allow-popups enabled, crafts a clickable link that triggers navigation or popup behavior leading to script execution, and relies on user interaction to violate the sandbox policy.

How to fix it

Upgrade Mozilla Firefox to version 98 or later, Firefox ESR to 91.7 or later, and Thunderbird to 91.7 or later; apply vendor patches promptly and verify installation across all endpoints.

How to confirm the fix worked

Confirm updated browser versions via about:support or equivalent; test iframe sandbox behavior with proof-of-concept markup to ensure script execution is blocked without allow-scripts.

Typical attack path

1. Identify or control a web page embedding a sandboxed iframe with allow-popups but without allow-scripts
2. Craft a malicious link inside the iframe that abuses popup or navigation semantics
3. Lure a victim into clicking the link
4. Achieve JavaScript execution outside the intended sandbox constraints

How to detect it

Examine browser history, extension logs, or proxy captures for unexpected script activity originating from sandboxed frames; correlate with user-reported unexpected popups or redirects on trusted sites.

What your security team should do

• Prioritize browser and email client updates across the fleet within the next patching cycle
• Enforce automatic updates where possible and audit for unpatched instances
• Review web content policies to minimize reliance on legacy sandbox attributes
• Monitor vendor advisories for related regressions