The content security policy (CSP) \sandbox\ directive did not create a unique origin for the document causing it to behave as if the \allow-same-origin\ keyword were always specified. This could allow a Cross-Site Scripting (XSS) attack to be launched from unsafe content. This vulnerability affects Firefox < 56 Firefox ESR < 52.4 and Thunderbird < 52.4.