CVE-2021-43543

6.1 mediumEPSS 1.5%

Medium (6.1). EPSS 1.5% chance of exploitation in the next 30 days.

Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 1.5% chance of exploitation in the next 30 days; higher than 73% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2021-12-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

debian:debian_linux
mozilla:firefox
mozilla:firefox_esr
mozilla:thunderbird

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1738418
https://lists.debian.org/debian-lts-announce/2021/12/msg00030.html
https://lists.debian.org/debian-lts-announce/2022/01/msg00001.html
https://security.gentoo.org/glsa/202202-03
https://security.gentoo.org/glsa/202208-14

Check your stack JSON