Permission bypass via cross-origin inheritance

Permission bypass in Firefox, Firefox ESR, and Thunderbird before their fixed releases allows remote attackers to obtain top-level origin permissions. Faulty FeaturePolicy inheritance lets a deeply nested cross-origin document inserted through an embed or object element reuse the top-level origin's microphone, camera, or geolocation permission, bypassing the normal prompt. The attack requires a user to load attacker-controlled nested content; the result is unauthorized access to permission-protected device capabilities or prompts presented as the trusted top-level site.