Total vulnerabilities in the database
Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP frame-src bypass and DOM-based XSS through the Google SafeFrame shim in the Web Compatibility extension. This issue could have exposed users to malicious frames masquerading as legitimate content. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Firefox ESR < 115.18, Thunderbird < 133, Thunderbird < 128.5, and Thunderbird < 115.18.
| Software | From | Fixed in |
|---|---|---|
| mozilla / firefox | - | 115.8.0 |
| mozilla / thunderbird | 129.0 | 133.0 |
| mozilla / firefox | - | 133.0 |
| mozilla / thunderbird | - | 115.18.0 |
| mozilla / thunderbird | 116.0 | 128.5.0 |
| mozilla / firefox | 116.0 | 128.5.0 |