CVE-2024-0747

CVE-2024-0747 describes a vulnerability where a parent page's Content Security Policy (CSP) could override a child iframe's CSP if the iframe was loaded with "unsafe-inline." This flaw impacts Firefox versions prior to 122, Firefox ESR before 115.7, and Thunderbird before 115.7. Rated with a CVSS score of 6.5 (Medium), this vulnerability has a network attack vector and low attack complexity, requiring user interaction. A successful exploit could lead to high integrity impact, allowing an attacker to bypass the child iframe's security policies. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. The vulnerability has received minimal community discussion and media coverage, indicating low public awareness.