CVE-2022-26384

If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scripts</code>, they were able to craft a link that, when clicked, would lead to JavaScript execution in violation of the sandbox. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.

• CWE-693

• https://bugzilla.mozilla.org/show_bug.cgi?id=1744352Exploit, Issue Tracking, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-10/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-11/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-12/Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1744352Exploit, Issue Tracking, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-10/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-11/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-12/Vendor Advisory

Published

Dec 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-26377Inconsistent Interpretation of HTTP Requests ('HTTP Request …7.5
• CVE-2022-2638The Export All URLs WordPress plugin before 4.4 does not val…6.5
• CVE-2022-26380A vulnerability has been identified in SCALANCE X302-7 EEC (…7.5
• CVE-2022-26381An attacker could have caused a use-after-free by forcing a …8.8
• CVE-2022-26382While the text displayed in Autofill tooltips cannot be dire…4.3
• CVE-2022-26383When resizing a popup after requesting fullscreen access, th…4.3
• CVE-2022-26385In unusual circumstances, an individual thread may outlive t…6.5
• CVE-2022-26386Previously Firefox for macOS and Linux would download tempor…6.5
• CVE-2022-26387When installing an add-on, Firefox verified the signature be…7.5
• CVE-2022-26388A use of hard-coded password vulnerability may allow authent…6.4
• CVE-2022-26389An improper access control vulnerability may allow privilege…7.7
• CVE-2022-2639An integer coercion error was found in the openvswitch kerne…7.8