#VU64757 Security features bypass in Mozilla Firefox - CVE-2022-34474

Vulnerability identifier: #VU64757

Vulnerability risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-34474

CWE-ID: CWE-254

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Mozilla Firefox
Client/Desktop applications / Web browsers

Vendor: Mozilla

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to an error when handling sandboxed iframes with allow-top-navigation-by-user-activation. A remote attacker can pass a redirect header to an external protocol to the browser and force the browser to process the redirect. The browser however will prompt the user as appropriate.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 92.0 - 101.0.1

---

External links
https://www.mozilla.org/en-US/security/advisories/mfsa2022-24/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.