CVE-2021-23957: 
NixOS vulnerability analysis and mitigation

CVE-2021-23957 is a security vulnerability discovered in Firefox for Android that affects versions prior to Firefox 85. The vulnerability allows navigation through the Android-specific intent URL scheme to bypass iframe sandbox restrictions. This issue was reported by security researcher Eliya Stein and was fixed in January 2021 (Mozilla Advisory, NVD).

The vulnerability exists in the way Firefox for Android handles intent URL schemes within sandboxed iframes. Even with standard sandbox attributes like 'allow-forms', 'allow-pointer-lock', 'allow-popups-to-escape-sandbox', 'allow-popups', 'allow-same-origin', 'allow-scripts', and 'allow-top-navigation-by-user-activation', malicious code could bypass these restrictions using the intent URL scheme. The vulnerability has a CVSS 3.1 score of 7.4 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N (Ubuntu).

The vulnerability could be exploited to perform unauthorized redirections without user interaction. Specifically, it allowed attackers to spawn Google Chrome from Firefox and open malicious pages, bypassing the intended sandbox protections. This vulnerability was actively exploited by malvertising campaigns to serve millions of forced mobile redirections (Mozilla Bugzilla).

The vulnerability was actively exploited in the wild by a malvertising operation known as Zirconium. The exploit involved using specific intent URL schemes within sandboxed iframes to bypass security restrictions and force redirections to malicious landing pages without user interaction (Mozilla Bugzilla).

The vulnerability was fixed in Firefox 85. Users should upgrade to Firefox 85 or later versions to protect against this vulnerability. The fix prevents unauthorized navigation through Android-specific intent URL schemes within sandboxed iframes (Mozilla Advisory).