Executive brief
A security flaw in Firefox and Thunderbird could allow malicious websites to bypass privacy protections and access sensitive features like your location. Normally, web browsers prevent embedded content from different websites from accessing these features without explicit permission. An attacker could use a specially crafted web link to trick the browser into granting this access, potentially compromising user privacy and data.
Technical details
A vulnerability in the DOM: Security component of Mozilla browsers allows a cross-origin iframe to bypass the Permission Policy (formerly Feature Policy) allow-list. By navigating an iframe to a 'blob:' URL containing malicious script, the content can request sensitive permissions, such as Geolocation, even if the parent document has not explicitly granted those permissions to the iframe's origin. This occurs because the security context check fails to properly enforce origin restrictions when a blob URL is involved. An attacker would need to entice a user to visit a malicious site or interact with a malicious iframe to trigger the bypass. The issue is fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, and corresponding Thunderbird releases.
Affected products
- Mozilla Firefox < 147
- Mozilla Firefox ESR < 115.32, < 140.7
- Mozilla Thunderbird < 147, < 140.7
Timeline
- 2026-01-13: disclosed
- 2026-01-13: advisory
- 2026-01-13: patched
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1999257
- https://www.mozilla.org/security/advisories/mfsa2026-01/
- https://www.mozilla.org/security/advisories/mfsa2026-02/
- https://www.mozilla.org/security/advisories/mfsa2026-03/
- https://www.mozilla.org/security/advisories/mfsa2026-04/
- https://www.mozilla.org/security/advisories/mfsa2026-05/
- https://access.redhat.com/errata/RHSA-2026:0667