Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
Thunderbird and LibreWolf run scripts when clicking JavaScript link
published 4 days ago
Summary
In Thunderbird and LibreWolf, an embedded frame that should not run code can be tricked into executing scripts if a user clicks a link that starts with "javascript:". This could let attackers run unwanted actions in the browser or email client. Update to the latest versions or apply the vendor’s recommended patches to stop this behavior.
What to do
- Update cleanstart thunderbird to version 102.0-r0.
- Update cleanstart thunderbird to version 102.1.0-r0.
- Update cleanstart librewolf to version 102.0-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | thunderbird |
< 102.0-r0 < 102.1.0-r0 Fix: upgrade to 102.0-r0
|
| CleanStart | cleanstart | librewolf |
< 102.0-r0 Fix: upgrade to 102.0-r0
|
Original advisory text
iframe that was not permitted to run scripts could do so if the user clicked on a <code>javascript:</code> link
CVE-2022-34468 affects multiple packages. An iframe that was not permitted to run scripts could do so if the user clicked on a <code>javascript:</code> link. See references for individual vulnerability details.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Timeline
Published31 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2024-ZG93605 · OSV
Track software like this
Free during beta