CVE-2023-28164

What it actually does

A cross-origin iframe removal during a drag operation can cause a dragged URL to be presented without proper origin context, enabling visual spoofing of the source.

Why it matters to the business

Users may be tricked into interacting with malicious content presented as originating from a trusted site, increasing risk of phishing or credential theft across browser and email clients.

How an attack unfolds

An attacker hosts a page containing a cross-origin iframe, initiates a drag of a URL from within that iframe, removes the iframe mid-drag, and relies on the browser to display the URL without accurate origin indicators to confuse the user about its true source.

How to fix it

Upgrade Mozilla Firefox to version 111 or later, Firefox ESR to 102.9 or later, and Thunderbird to 102.9 or later. Apply updates through official distribution channels as soon as available.

How to confirm the fix worked

Verify installed product versions meet or exceed Firefox 111, Firefox ESR 102.9, and Thunderbird 102.9. Re-test drag-and-drop behavior from cross-origin iframes in a controlled environment to confirm origin information is preserved.

Typical attack path

1. Attacker crafts a web page embedding a cross-origin iframe with a draggable URL element
2. Victim is lured to the attacker page and begins dragging the URL element
3. Attacker script removes the iframe during the drag operation
4. Browser displays the dragged URL without correct cross-origin context
5. User is misled about the URL's origin and completes an action such as dropping it into the address bar or another application

How to detect it

Review browser process logs and crash reports for unexpected iframe removal events during drag operations; correlate with user reports of unexpected navigation or address-bar spoofing.

What your security team should do

• Prioritize deployment of the listed browser and mail client updates across all managed endpoints
• Monitor vendor advisories for any follow-on patches or extended support releases
• Educate users on verifying URLs before completing drag-and-drop actions into address bars or bookmarks