CVE-2021-4140

CRITICAL

Firefox ESR < 91.5, Firefox < 96, Thunderbird < 91.5 - XSS

Title source: llm

Description

It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.

References (4)

[Exploit, Issue Tracking, Patch, Vendor Advisory] https://bugzilla.mozilla.org/show_bug.cgi?id=1746720

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2022-01/

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2022-02/

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2022-03/

Scores

CVSS v3 10.0

EPSS 0.0008

EPSS Percentile 23.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-91

Status published

Products (3)

mozilla/firefox < 96.0

mozilla/firefox_esr < 91.5

mozilla/thunderbird < 91.5

Published Dec 22, 2022

Tracked Since Feb 18, 2026