CVE-2022-29911 in Thunderbird
Summary
by MITRE • 12/22/2022
An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could lead to script execution without <code>allow-scripts</code> being present. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 06/23/2026
The vulnerability stems from an inadequate implementation of the iframe sandbox directive allow-top-navigation-by-user-activation which was introduced to provide controlled navigation capabilities within sandboxed environments. This particular flaw represents a critical security regression that undermines the fundamental security model of browser sandboxing mechanisms. The issue manifests when browsers process iframes with this specific sandbox keyword without requiring the explicit allow-scripts permission, creating an unintended execution pathway for malicious scripts. The vulnerability affects major browser distributions including Thunderbird versions prior to 91.9, Firefox Extended Support Release versions before 91.9, and standard Firefox releases before version 100, indicating a widespread impact across the Mozilla ecosystem.
The technical implementation flaw lies in the improper validation of sandbox directives where the system fails to properly enforce the security boundaries that should prevent script execution when allow-scripts is not explicitly granted. This misconfiguration allows attackers to construct malicious iframes that can navigate top-level windows while bypassing normal script execution restrictions, effectively creating a sandbox escape condition. The vulnerability operates through a combination of improper access control checks and inadequate privilege separation between sandboxed content and the parent browsing context. According to CWE-284, this represents an inadequate access control implementation that permits unauthorized actions through flawed security mechanism enforcement.
The operational impact of this vulnerability extends beyond simple script execution as it enables attackers to perform navigation-based attacks that can redirect users to malicious sites while maintaining the ability to execute arbitrary code within the sandboxed environment. This creates opportunities for phishing attacks, credential theft, and other malicious activities that leverage the trust relationship between the browser and its sandboxed content. The attack surface is particularly concerning because it allows navigation without explicit script permissions, potentially enabling attackers to chain this vulnerability with other exploits that rely on user interaction or navigation capabilities.
Security researchers have identified that this vulnerability aligns with ATT&CK technique T1059.007 which involves the execution of scripts through web browsers, and more specifically relates to T1203 which covers exploitation for privilege escalation. The mitigation strategy requires immediate patching of affected browser versions to ensure proper enforcement of sandbox directives. Organizations should implement browser hardening policies that restrict iframe usage where possible and deploy content security policy headers to further limit potential attack vectors. Additionally, regular security audits of web applications should verify proper sandbox implementation and monitor for unauthorized navigation attempts within sandboxed contexts. The fix addresses the core issue by ensuring that allow-top-navigation-by-user-activation cannot be used as a bypass mechanism for script execution without explicit permissions, thereby restoring the intended security boundaries of the browser sandboxing model.