Total vulnerabilities in the database
If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to the iframe's document that e.g. had a JavaScript event handler - the event handler would have run despite the iframe's sandbox. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
| Software | From | Fixed in |
|---|---|---|
| mozilla / firefox | - | 97.0 |
| mozilla / firefox_esr | - | 91.6 |
| mozilla / thunderbird | - | 91.6 |