Site isolation bypass via spoofed navigation origins

Origin validation errors in affected Mozilla Firefox, Firefox ESR, and Thunderbird releases allow attackers to load cross-origin pages. DOM navigation accepted an original URI supplied by a compromised content process without ensuring that it matched the channel URI, so site-isolation routing could select the wrong content process. Exploitation requires prior compromise of a content process; the bounded result is cross-origin page loading rather than reported code execution or host compromise.