CVE-2023-29540

What it actually does

The vulnerability permits a redirect embedded in sourceMappingUrls to trigger navigation to external protocol handlers from within sandboxed iframes that lack the allow-top-navigation-to-custom-protocols attribute, bypassing intended sandbox restrictions.

Why it matters to the business

Users of affected browser versions may be redirected to malicious external resources without explicit permission, increasing exposure to phishing or unwanted protocol invocations that could disrupt operations or lead to further compromise.

How an attack unfolds

An attacker embeds a crafted sourceMappingUrl containing an external protocol link inside content loaded in a sandboxed iframe on a page visited by the victim; when the mapping URL is processed, the browser performs the navigation without requiring the custom protocol allowance, enabling the redirect.

How to fix it

Upgrade Mozilla Firefox and Focus for Android to version 112 or later; ensure automatic updates are enabled and verify the installed version meets or exceeds the fixed release.

How to confirm the fix worked

Confirm the browser version is at least 112 via the about:support or settings page; test iframe navigation behavior with a controlled sourceMappingUrl to ensure sandbox restrictions are enforced.

Typical attack path

1. Attacker prepares a web page containing a sandboxed iframe with malicious sourceMappingUrl pointing to an external protocol handler
2. Victim is lured to the attacker's page via phishing or compromised site
3. Browser processes the sourceMappingUrl and initiates the unauthorized navigation
4. Victim's browser follows the redirect to the attacker-controlled external resource

How to detect it

Review browser update logs and version telemetry for pre-112 instances; inspect web server or proxy logs for unexpected external protocol navigation attempts originating from sandboxed iframe contexts.

What your security team should do

• Prioritize updating all instances of Firefox and Focus for Android to version 112 or newer immediately
• Monitor EPSS and exploit maturity indicators for any increase in risk
• Review sandboxed iframe usage in internal web applications for similar redirect patterns
• Educate users on verifying browser versions and enabling updates