CVE-2020-15653: 
NixOS vulnerability analysis and mitigation

CVE-2020-15653 is a security vulnerability discovered in Firefox browsers that allows bypassing iframe sandbox restrictions when using noopener links with the allow-popups flag enabled. The vulnerability was discovered by Mozilla developer Anne van Kesteren and affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1. The issue was disclosed and patched in July 2020 (Mozilla Advisory).

The vulnerability occurs when an iframe sandbox element with the allow-popups flag could be bypassed specifically when using noopener links. This security flaw has a CVSS v3.1 Base Score of 6.5 (Medium) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N (NVD). The issue was particularly concerning for websites that relied on sandbox configurations that allowed popups while hosting arbitrary content.

The vulnerability could lead to security issues for websites relying on sandbox configurations that allowed popups and hosted arbitrary content. This could potentially allow attackers to bypass intended security restrictions and execute unauthorized actions (Mozilla Advisory).

The vulnerability requires user interaction and can be exploited when a user interacts with a specially crafted website. The severity was rated as moderate by Mozilla, indicating a significant but not critical security risk (Mozilla Advisory).

The vulnerability was fixed in Firefox 79.0, Firefox ESR 78.1, and Thunderbird 78.1. Users are advised to update their browsers to these versions or later. For Ubuntu users, the fix was provided in firefox version 79.0+build1-0ubuntu0.20.04.1 for Ubuntu 20.04, 79.0+build1-0ubuntu0.18.04.1 for Ubuntu 18.04, and 79.0+build1-0ubuntu0.16.04.2 for Ubuntu 16.04 (Ubuntu Advisory).