CVE-2026-110802

The Altair GraphQL client (versions 7.2.4 through 8.5.8 ) is vulnerable to a DOM-based XSS due to improper handling of the plugin_sandbox_opts query string parameter in packages/altair-iframe-sandbox/src/main.ts. An attacker can provide malicious scriptUrls which are passed to injectScript() in p...

CVE-2026-120987

Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment...

CVE-2026-120987

Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment...

CVE-2026-120987

Whale Browser versions prior to 5.39.412.57 are vulnerable to an iframe sandbox bypass occurring within a dual-tab environment . The root cause is associated with an Origin Validation Error (CWE-346). No specific exploit details or remediation instructions are provided in the documents.

EUVD-2026-115692

Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment...

CLEANSTART-2024-VA87532 This issue was addressed with improved iframe sandbox enforcement

Security vulnerability affects the webkit2gtk package. This issue was addressed with improved iframe sandbox enforcement...

CLEANSTART-2024-DQ40163 This issue was addressed with improved iframe sandbox enforcement

Security vulnerability affects the webkit2gtk package. This issue was addressed with improved iframe sandbox enforcement...

CLEANSTART-2024-SY87039 This issue was addressed with improved iframe sandbox enforcement

Security vulnerability affects the webkit2gtk package. This issue was addressed with improved iframe sandbox enforcement...

CLEANSTART-2024-BO25852 Navigations through the Android-specific `intent` URL scheme could have been misused to escape iframe sandbox

Security vulnerability affects the librewolf package. Navigations through the Android-specific intent URL scheme could have been misused to escape iframe sandbox...

CLEANSTART-2024-VB22624 It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox

CVE-2021-4140 affects multiple packages. It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. See references for individual vulnerability details...

CLEANSTART-2024-AD64332 improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could lead to script execution without <code>allow-scripts</code> being present

CVE-2022-29911 affects multiple packages. An improper implementation of the new iframe sandbox keyword allow-top-navigation-by-user-activation could lead to script execution without allow-scripts being present. See references for individual vulnerability details...

CLEANSTART-2024-FX18211 Navigations through the Android-specific `intent` URL scheme could have been misused to escape iframe sandbox

Security vulnerability affects the firefox package. Navigations through the Android-specific intent URL scheme could have been misused to escape iframe sandbox...

CLEANSTART-2024-JU77780 It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox

CVE-2021-4140 affects multiple packages. It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. See references for individual vulnerability details...

CLEANSTART-2024-ZJ91140 improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could lead to script execution without <code>allow-scripts</code> being present

CVE-2022-29911 affects multiple packages. An improper implementation of the new iframe sandbox keyword allow-top-navigation-by-user-activation could lead to script execution without allow-scripts being present. See references for individual vulnerability details...

Exploit for CVE-2026-116004

CVE-2026-116004 — Onyx same-origin iframe sandbox bypass / sto...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the iFrameSandbox of Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions through a crafted HTML page...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the iFrame Sandbox in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to bypass navigation restrictions through a crafted HTML page...

Astra Linux – vulnerability in Chromium

Insufficient policy enforcement in the iframe sandbox in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page...

Astra Linux – Vulnerability in Firefox, Thunderbird

The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or navigating the top-level frame. This vulnerability affects Firefox 94, Thunderbird 91.3, and Firefox ESR 91.3...

Rocky Linux 8 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2022_1705)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20221705 advisory. Mozilla: Bypassing permission prompt in nested browsing contexts CVE-2022-29909 Mozilla: iframe Sandbox bypass CVE-2022-29911 Mozilla: Fullscreen...