CLEANSTART-2024-AL32480 Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the existing prompt and wrongfully inheriting the top-level perm...

🗓️ 31 Oct 2026 14:29:57Reported by GoogleType

osv_cleanstart🔗 osv.dev👁 4 Views

Documents in nested cross-origin contexts can inherit top-level permissions.

Reporter	Title	Published	Views	Family All 206
ALT Linux	Security fix for the ALT Linux 10 package firefox-esr version 91.9.0-alt1	4 May 202200:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package thunderbird version 91.9.0-alt1	4 May 202200:00	–	altlinux
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Mozilla Firefox affect IBM Cloud Pak for Multicloud Management Monitoring.	31 Jan 202314:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities of Mozilla Firefox (less than Firefox 102.2ESR) have affected Synthetic Playback Agent 8.1.4.0-8.1.4 IF16 - 2022.4.0	15 Nov 202205:24	–	ibm
Tenable Nessus	AlmaLinux 8 : firefox (ALSA-2022:1705)	12 May 202200:00	–	nessus
Tenable Nessus	AlmaLinux 8 : thunderbird (ALSA-2022:1730)	12 May 202200:00	–	nessus
Tenable Nessus	AlmaLinux 9 : thunderbird (ALSA-2022:4589)	16 Nov 202200:00	–	nessus
Tenable Nessus	AlmaLinux 9 : firefox (ALSA-2022:4590)	16 Nov 202200:00	–	nessus
Tenable Nessus	CentOS 7 : firefox (RHSA-2022:1703)	6 May 202200:00	–	nessus
Tenable Nessus	CentOS 7 : thunderbird (RHSA-2022:1725)	6 May 202200:00	–	nessus

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2024/CLEANSTART-2024-AL32480.json
osv	www.osv.dev/vulnerability/CVE-2022-29909
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-29909

31 Oct 2026 15:45Current

7.8High risk

Vulners AI Score7.8

CVSS 3.18.8

EPSS0.00889

library cross-origin permission inheritance