CVE-2023-28164: Mozilla Firefox

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.

Affected products

• Mozilla Firefox: before 111.0 (fixed in 111.0)
• Mozilla Firefox ESR: before 102.9 (fixed in 102.9)
• Mozilla Thunderbird: before 102.9 (fixed in 102.9)

Published 2023-06-02. Last modified 2026-06-17.