CVE-2022-29911

What it actually does

The flaw permits an attacker-controlled iframe using the sandbox attribute with allow-top-navigation-by-user-activation (but without allow-scripts) to execute scripts or perform top-level navigation, bypassing the intended sandbox restrictions on script execution.

Why it matters to the business

Attackers can run unauthorized code inside end-user browsers on widely deployed Mozilla products, enabling data exfiltration, session hijacking, or phishing without user awareness and increasing incident response workload across large user bases.

How an attack unfolds

An attacker hosts a page containing a sandboxed iframe that relies on the flawed allow-top-navigation-by-user-activation keyword; when the victim interacts with the page, the browser incorrectly grants script execution or top navigation privileges, allowing the attacker to escape the sandbox and perform actions that should have been blocked.

How to fix it

Upgrade Mozilla Firefox to version 100 or later, Firefox ESR to 91.9 or later, and Thunderbird to 91.9 or later; enable automatic updates where possible and verify installed versions match or exceed these releases.

How to confirm the fix worked

Confirm browser and Thunderbird versions meet or exceed the fixed releases; test iframe sandbox behavior with a proof-of-concept page exercising allow-top-navigation-by-user-activation to ensure script execution remains blocked without allow-scripts.

Typical attack path

1. Host malicious page embedding a sandboxed iframe using only allow-top-navigation-by-user-activation
2. Lure victim to the page via phishing or compromised site
3. Wait for user activation to trigger the bypass
4. Execute scripts or navigate top-level window to deliver payload or steal data

How to detect it

Search browser history, download logs, and proxy records for visits to suspicious domains followed by unexpected top-level navigations or script-initiated actions from sandboxed frames; correlate with EDR process creation events showing browser child processes performing unusual navigation.

What your security team should do

• Prioritize browser and email client upgrades across all managed endpoints within the next 30 days
• Block legacy vulnerable versions via enterprise policy or application control
• Add browser version checks to endpoint compliance scanning
• Review web proxy or EDR logs for post-exploitation indicators if any unpatched systems remain