If a page is loaded from an original site through a hyperlink and contains a redirect to a \data:text/html\ URL triggering a reload will run the reloaded \data:text/html\ page with its origin set incorrectly. This allows for a cross-site scripting (XSS) attack. This vulnerability affects Thunderbird < 52.1 Firefox ESR < 52.1 and Firefox < 53.