Is the workaround SAFE for Chrome 92 breaks button actions (Reset Password, custom VF) fix in SFDC?

Question

Is the offered workaround from this known issue universally safe?

I ask because it isn't crystal clear (to me) from the Firefox docs that the danger inherent in different-origin Iframe JavaScript dialogs is or isn't still a danger in Firefox. Especially because Google and Microsoft (Edge) have both "plugged the hole". So, either:

1. Google and Microsoft made the vulnerability-correction over-broad and Firefox has found a narrower fix; or
2. Firefox hasn't been "fixed" and we are being asked to have our users/admins workaround the fix and be exposed to a known vulnerability should they open another tab or site (assuming Salesforce is safe with the workaround).

Google states in the M92 Release Notes that:

"Different-origin iframes cannot trigger JavaScript dialogs

Chrome 92 prevents iframes from triggering prompts (window.alert, window.confirm, window.prompt) if the iframe is a different origin from the top-level page. This change is intended to prevent embedded content from spoofing the user into believing a message is coming from the website they're visiting, or from Chrome itself. If you have any web apps affected by this change, you can use the temporary enterprise policy SuppressDifferentOriginSubframeDialogs to revert to the previous behavior. This policy will be removed in Chrome 95.", page 3

So, we are leery of switching to a browser that isn't normally used by our organization in order to accommodate what is either a bad dev practice or deprecated technique.

Answer 1

Although this is not technically an Answer, the issue is apparently moot now - a co-admin reported that she was able to use Chrome today to reset a password, and when I tried, I was able to, too. I had noted my Chrome version/subversion yesterday - still the same, so maybe Salesforce did a hot-patch? And a (till this moment) unacknowledged hot-patch!

Thus leaving this in the class of software issues that I've always called "It magically started working again", ala Monty Python I Got Better

Thanks for the input all; btw we are "wide open" internet for staff, so the vulnerability patch is a welcome one.

Answer 2

The risk may be manageable, but that's dependent on what your users are allowed to use, which sites they are allowed to visit, etc.

For example, if users are strictly only allowed to go to Salesforce, and you have no external systems unaccounted for in your org (e.g. no canvas apps you don't control, etc), the risk should be all but non-existent. If you have a ton of different apps your users use, and those apps may have vulnerabilities, etc, it may be a high risk. There's no way we can tell you with 100% certainty that there's no risk involved.

That said, you can choose to use the SuppressDifferentOriginSubframeDialogs policy to re-enable the old behavior, and, as per the documentation, this will be fixed in a future release, so switching browsers may be overkill.