Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
Librewolf browser may open external links from sandboxed frames
published 4 days ago
Summary
The Librewolf web browser can be tricked into opening links that use special protocols (like mail links or custom app links) even when those links appear inside a restricted part of a web page. This may cause users to see unexpected prompts and could be used to lure them into unwanted actions. Install the latest Librewolf update or apply the vendor’s patch to stop the browser from following those redirects.
What to do
- Update cleanstart librewolf to version 102.0-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | librewolf |
< 102.0-r0 Fix: upgrade to 102.0-r0
|
Original advisory text
Even when an iframe was sandboxed with <code>allow-top-navigation-by-user-activation</code>, if it received a redirect header to an external protocol the browser would process the redirect and prom...
Security vulnerability affects the librewolf package. Even when an iframe was sandboxed with <code>allow-top-navigation-by-user-activation</code>, if it received a redirect header to an external protocol the browser would process the redirect and prompt the user as appropriate.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published31 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2024-XM47780 · OSV
Track software like this
Free during beta