An iframe that was not permitted to run scripts could do so if the user clicked on a <code>javascript:</code> link. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11.
https://www.mozilla.org/security/advisories/mfsa2022-26/
https://www.mozilla.org/security/advisories/mfsa2022-25/