CVE-2022-29909

Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the existing prompt and wrongfully inheriting the top-level permissions. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100.

• CWE-276
• CWE-276

• https://bugzilla.mozilla.org/show_bug.cgi?id=1755081Issue Tracking, Permissions Required, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-16/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-17/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-18/Mailing List
• https://bugzilla.mozilla.org/show_bug.cgi?id=1755081Issue Tracking, Permissions Required, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-16/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-17/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-18/Mailing List
• https://bugzilla.mozilla.org/show_bug.cgi?id=1755081Issue Tracking, Permissions Required, Vendor Advisory

Published

Dec 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29903The Private Domains extension for MediaWiki through 1.37.2 (…4.3
• CVE-2022-29904The SemanticDrilldown extension for MediaWiki through 1.37.2…9.8
• CVE-2022-29905The FanBoxes extension for MediaWiki through 1.37.2 (before …4.3
• CVE-2022-29906The admin API module in the QuizGame extension for MediaWiki…9.8
• CVE-2022-29907The Nimbus skin for MediaWiki through 1.37.2 (before 6f9c8fb…6.1
• CVE-2022-29908The folioupdate service in Fabasoft Cloud Enterprise Client …7.8
• CVE-2022-2991A heap-based buffer overflow was found in the Linux kernel's…6.7
• CVE-2022-29910When closed or sent to the background, Firefox for Android w…6.1
• CVE-2022-29911An improper implementation of the new iframe sandbox keyword…6.1
• CVE-2022-29912Requests initiated through reader mode did not properly omit…6.1
• CVE-2022-29913The parent process would not properly check whether the Spee…6.5
• CVE-2022-29914When reusing existing popups Firefox would have allowed them…6.5