VDB
CVE-2022-29911
CVE-2022-29911
PUBLISHED
CVSS 6.1 MEDIUM
Reported by mozilla · Published December 22, 2022
An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could lead to script execution without <code>allow-scripts</code> being present. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| firefox | Arch Linux | 100.0-1 |
| thunderbird | Alpine | 91.9.0-r0 |
| librewolf | Alpine | 100.0-r0 |
| firefox-esr | Alpine | 91.9.0-r0 |
| firefox | Alpine | 100.0-r0 |
| thunderbird | Arch Linux | 91.9-1 |
| firefox_esr | mozilla | 91.9 |
| firefox | mozilla | 100.0, 100 |
| Thunderbird | Mozilla | 91.9 |
| Firefox ESR | Mozilla | 91.9 |
Risk scores
CVSS 3.1
6.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Thunderbird | unspecified |
| Mozilla | Firefox ESR | unspecified |
| Mozilla | Firefox | unspecified |
| arch | firefox | 0 |
| alpine | thunderbird | 0 |
| alpine | librewolf | 0 |
| alpine | firefox-esr | 0 |
| Mozilla | Thunderbird | * |
| alpine | firefox | 0 |
| arch | thunderbird | 0 |
| Mozilla | Firefox | * |
| Mozilla | Firefox ESR | * |
Timeline
- May 3, 2022 CVE Published
- Dec 23, 2022 EPSS Score (30 in total, the first dated here)
- Oct 6, 2025 CVE Updated
- Jun 2, 2026 Security Advisory (17 in total, the first dated here)
- Jun 26, 2026 Coalition ESS Score
- Nov 4, 2026 Distribution Patch (14 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2022-29911
vulnetix vdb fixes CVE-2022-29911Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2022-29911/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart