CVE-2022-28286

Debido a un cambio de diseño, es posible que el contenido del iframe se haya representado fuera de su borde. Esto podría haber provocado confusión en el usuario o ataques de suplantación de identidad. Esta vulnerabilidad afecta a Thunderbird < 91.8, Firefox < 99 y Firefox ESR < 91.8.

The Mozilla Foundation Security Advisory describes this flaw as: Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user confusion or spoofing attacks.

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, conduct spoofing attacks, or execute arbitrary code. It was discovered that Thunderbird ignored OpenPGP revocation when importing a revoked key in some circumstances. An attacker could potentially exploit this by tricking the user into trusting the authenticity of a message or tricking them into use a revoked key to send an encrypted message.