Mozilla Thunderbird and Firefox CSP Frame Navigation Vulnerability

A vulnerability exists in Mozilla Thunderbird and Firefox that relates to how navigations in frames are validated. The issue arises because the applications ignored paths when enforcing Content Security Policy (CSP) directives, specifically the 'frame-src' policy. This flaw could potentially be exploited in browser-like contexts, despite scripting being disabled for email in Thunderbird.

Impact

Exploitation of this vulnerability could lead to improper enforcement of Content Security Policy, allowing for unauthorized navigations in frames.

Remediation

Users can update to Thunderbird 141 or Firefox 141 to address this vulnerability.