CVE-2022-26384
First published: Tue Mar 08 2022(Updated: )
If an attacker could control the contents of an iframe sandboxed with `allow-popups` but not `allow-scripts`, they were able to craft a link that, when clicked, would lead to JavaScript execution in violation of the sandbox. External Reference: <a href="https://www.mozilla.org/en-US/security/advisories/mfsa2022-11/#CVE-2022-26384">https://www.mozilla.org/en-US/security/advisories/mfsa2022-11/#CVE-2022-26384</a>
Credit: security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Firefox ESR | <91.7 | 91.7 |
| <98 | 98 | |
| <91.7 | 91.7 | |
| <91.7 | 91.7 | |
| redhat/firefox | <0:91.7.0-3.el7_9 | 0:91.7.0-3.el7_9 |
| redhat/thunderbird | <0:91.7.0-2.el7_9 | 0:91.7.0-2.el7_9 |
| redhat/firefox | <0:91.7.0-3.el8_5 | 0:91.7.0-3.el8_5 |
| redhat/thunderbird | <0:91.7.0-2.el8_5 | 0:91.7.0-2.el8_5 |
| redhat/firefox | <0:91.7.0-3.el8_1 | 0:91.7.0-3.el8_1 |
| redhat/thunderbird | <0:91.7.0-2.el8_1 | 0:91.7.0-2.el8_1 |
| redhat/firefox | <0:91.7.0-3.el8_2 | 0:91.7.0-3.el8_2 |
| redhat/thunderbird | <0:91.7.0-2.el8_2 | 0:91.7.0-2.el8_2 |
| redhat/firefox | <0:91.7.0-3.el8_4 | 0:91.7.0-3.el8_4 |
| redhat/thunderbird | <0:91.7.0-2.el8_4 | 0:91.7.0-2.el8_4 |
| redhat/firefox | <91.7 | 91.7 |
| redhat/thunderbird | <91.7 | 91.7 |
| Mozilla Firefox | <98.0 | |
| Mozilla Firefox ESR | <91.7 | |
| Mozilla Thunderbird | <91.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.mozilla.org/show_bug.cgi?id=1744352
- https://www.mozilla.org/en-US/security/advisories/mfsa2022-11/
- https://www.mozilla.org/en-US/security/advisories/mfsa2022-10/
- https://www.mozilla.org/en-US/security/advisories/mfsa2022-11/#CVE-2022-26386
- https://www.mozilla.org/en-US/security/advisories/mfsa2022-12/
- https://www.mozilla.org/security/advisories/mfsa2022-10/
- https://www.mozilla.org/security/advisories/mfsa2022-11/
- https://www.mozilla.org/security/advisories/mfsa2022-12/
- https://www.mozilla.org/en-US/security/advisories/mfsa2022-11/#CVE-2022-26384
- https://access.redhat.com/errata/RHSA-2022:0815
- https://access.redhat.com/errata/RHSA-2022:0816
- https://access.redhat.com/errata/RHSA-2022:0818
- https://access.redhat.com/errata/RHSA-2022:0817
- https://access.redhat.com/errata/RHSA-2022:0824
- https://access.redhat.com/errata/RHSA-2022:0843
- https://access.redhat.com/errata/RHSA-2022:0847
- https://access.redhat.com/errata/RHSA-2022:0845
- https://access.redhat.com/errata/RHSA-2022:0853
- https://access.redhat.com/errata/RHSA-2022:0850
- https://access.redhat.com/security/cve/cve-2022-26384
- https://bugzilla.redhat.com/show_bug.cgi?id=2062221
- https://www.cve.org/CVERecord?id=CVE-2022-26384 https://nvd.nist.gov/vuln/detail/CVE-2022-26384 https://www.mozilla.org/en-US/security/advisories/mfsa2022-11/#CVE-2022-26384 https://www.mozilla.org/en-US/security/advisories/mfsa2022-12/#CVE-2022-26384
Parent vulnerabilities
(Appears in the following advisories)
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is the severity of CVE-2022-26384?
The severity of CVE-2022-26384 is critical.
Which software is affected by CVE-2022-26384?
Firefox versions less than 98 and Firefox ESR versions less than 91.7 are affected by CVE-2022-26384. Additionally, Red Hat packages for Firefox and Thunderbird versions less than 91.7 are also affected.
How can an attacker exploit CVE-2022-26384?
An attacker can exploit CVE-2022-26384 by controlling the contents of an iframe sandboxed with allow-popups but not allow-scripts, and crafting a link that leads to JavaScript execution in violation of the sandbox.
What is the remediation for CVE-2022-26384?
To remediate CVE-2022-26384, update Firefox to version 98 or later, or update Firefox ESR to version 91.7 or later. Red Hat users should update the Firefox and Thunderbird packages to version 91.7 or later.
Where can I find more information about CVE-2022-26384?
You can find more information about CVE-2022-26384 on the Mozilla Security Advisories page and the Bugzilla report.
- collector/redhat-cve
- collector/mozilla-advisory
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- agent/author
- agent/references
- agent/severity
- agent/weakness
- source/Mozilla
- agent/software-canonical-lookup
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-26384
- agent/description
- agent/event
- agent/software-canonical-lookup-request
- agent/tags
- collector/nvd-index
- collector/mitre-cve
- source/MITRE
- package-manager/redhat
- vendor/mozilla
- canonical/mozilla firefox esr
- canonical/mozilla thunderbird
- canonical/mozilla firefox