CVE-2021-4140: Critical severity Mozilla Firefox vulnerability
It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 91.5 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 96 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 91.5
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2021-4140.
What is the severity of CVE-2021-4140?
The severity of CVE-2021-4140 is critical.
Which software versions are affected by CVE-2021-4140?
CVE-2021-4140 affects Firefox ESR versions before 91.5, Firefox versions before 96, and Thunderbird versions before 91.5.
How can an attacker exploit CVE-2021-4140?
An attacker can exploit CVE-2021-4140 by constructing specific XSLT markup to bypass an iframe sandbox.
Where can I find more information about CVE-2021-4140?
You can find more information about CVE-2021-4140 in the following references: [Mozilla Bugzilla](https://bugzilla.mozilla.org/show_bug.cgi?id=1746720), [Mozilla Security Advisory MFSA2022-03](https://www.mozilla.org/en-US/security/advisories/mfsa2022-03/), [Mozilla Security Advisory MFSA2022-01](https://www.mozilla.org/en-US/security/advisories/mfsa2022-01/).