Mozilla Thunderbird and Firefox Process Isolation Vulnerability via Cross-Origin 'javascript:' URIs

A process isolation vulnerability has been identified in Mozilla Thunderbird and Firefox. This vulnerability arises from improper handling of 'javascript:' URIs, which can allow content to execute in the top-level document's process instead of the intended frame. Such a flaw could potentially enable a sandbox escape. The issue affects multiple versions of Firefox and Thunderbird, particularly those prior to version 138 and certain Firefox ESR releases.

Impact

Exploitation of this vulnerability could lead to a process isolation bypass, allowing content to execute in a privileged context and potentially escape sandbox restrictions.

Remediation

Users can update to Thunderbird 138, Firefox 138, or the relevant Firefox ESR versions to address this vulnerability.