Mozilla Firefox 93, Mozilla Firefox ESR 91.2 and Thunderbird 91.2 : Through use of code reportValidity()/code and code window.open()/code , a plain-text validation message could have been overlaid on another origin, leading to possible user confusion and spoofing attacks.