CVE-2022-26384: 
NixOS vulnerability analysis and mitigation

CVE-2022-26384 is a security vulnerability discovered in Firefox and Thunderbird browsers that was disclosed and patched in March 2022. The vulnerability allowed attackers to bypass iframe sandbox restrictions, specifically when an iframe was sandboxed with allow-popups but not allow-scripts permissions (Mozilla Advisory).

The vulnerability occurs when an attacker controls the contents of an iframe that is sandboxed with allow-popups but not allow-scripts permissions. The attacker could craft a link that, when clicked, would lead to JavaScript execution in violation of the sandbox restrictions. This behavior was unique to Firefox as other browsers like Edge, Chrome, and Safari blocked such attempts (Mozilla Advisory, Red Hat CVE).

The vulnerability was rated as having a high security impact as it allowed JavaScript execution in violation of sandbox security controls. This could potentially allow attackers to execute arbitrary JavaScript code in contexts where it should have been blocked by the sandbox restrictions (Mozilla Advisory).

The vulnerability was fixed in Firefox 98, Firefox ESR 91.7, and Thunderbird 91.7. The fix involved ensuring proper enforcement of sandbox flags when opening or replacing toplevel browsing contexts (Red Hat Advisory).