Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. #CVE-2022-29912: Reader mode bypassed SameSite cookies Reporter Matheus Vrech Impact moderate Description #CVE-2022-29911: iframe Sandbox bypass Reporter Trung Pham Impact high DescriptionĪn improper implementation of the new iframe sandbox keyword allow-top-navigation-by-user-activation could lead to script execution without allow-scripts being present. This could have been used to probe the browser history.

#CVE-2022-29916: Leaking browser history with CSS variables Reporter Mateusz Sionkowski Impact high Descriptionįirefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables. #CVE-2022-29909: Bypassing permission prompt in nested browsing contexts Reporter Armin Ebert Impact high Descriptionĭocuments in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the existing prompt and wrongfully inheriting the top-level permissions. When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofing attacks. #CVE-2022-29914: Fullscreen notification bypass using popups Reporter Irvan Kurniawan Impact high Description Mozilla Foundation Security Advisory 2022-17 Security Vulnerabilities fixed in Firefox ESR 91.9 Announced Impact high Products Firefox ESR Fixed in

Mozilla firefox esr 17