Critical · published April 29, 2025
🚨 A sneaky process isolation issue in Thunderbird could let malicious content escape its intended frame and wreak havoc! 🔥 Think of it like a restaurant kitchen where a chef mistakenly lets an unapproved delivery driver into the main dining area, where they could potentially serve contaminated food right to the guests! An attacker could exploit this vulnerability to execute dangerous scripts in the top-level document, leading to unauthorized access and data leakage. The consequences could be absolutely devastating, putting users' sensitive information at risk and bypassing the intended security measures!
Think of it like a restaurant kitchen where a chef mistakenly lets an unapproved delivery driver into the main dining area, where they could potentially serve contaminated food right to the guests! This process isolation vulnerability arises from improper handling of javascript: URIs, allowing them to execute in the wrong context — the top-level document's process, instead of the isolated frame meant to contain them.
An attacker could exploit this vulnerability to execute dangerous scripts in the top-level document, leading to unauthorized access and data leakage. The consequences could be absolutely devastating, putting users' sensitive information at risk and bypassing the intended security measures! To protect your users, immediately update to Thunderbird version 138 or 128.10, or Firefox versions 138, 128.10, or 115.23. Always ensure your software is up to date to guard against such vulnerabilities! You've got this! Get those updates rolling and keep your systems secure! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| mozilla/firefox | < 115.23 | 115.23 |
| mozilla/firefox | < 138.0 | 138.0 |
| mozilla/firefox | ≥ 128.0, < 128.10 | 128.10 |
| mozilla/thunderbird | < 128.10.0 | 128.10.0 |
| mozilla/thunderbird | < 138.0 | 138.0 |