CVE-2021-43542

What it actually does

The flaw permits a remote attacker to enumerate installed applications on the victim's system by issuing XMLHttpRequest calls that trigger distinguishable error responses when probing for the presence of external protocol handlers.

Why it matters to the business

Attackers can silently fingerprint user environments to enable more precise follow-on attacks, increasing the risk of targeted malware delivery or privacy violations across browser users.

How an attack unfolds

An attacker hosts a malicious webpage that uses JavaScript to perform XMLHttpRequests against a list of known external protocols; differing error messages reveal which applications are installed, allowing the attacker to tailor subsequent exploits.

How to fix it

Upgrade Firefox to version 95 or later, Firefox ESR to 91.4.0 or later, and Thunderbird to 91.4.0 or later. Apply vendor patches as soon as they become available for all affected Mozilla products.

How to confirm the fix worked

Confirm browser and email client versions meet or exceed the fixed releases listed in the advisory; re-test the XMLHttpRequest protocol-probing behavior in an isolated environment to verify error messages no longer leak application presence.

Typical attack path

1. Victim visits attacker-controlled website
2. Malicious JavaScript executes in browser context
3. Code issues XMLHttpRequests for candidate protocol URIs
4. Error responses are inspected to map installed applications
5. Attacker selects follow-on payloads based on discovered software

How to detect it

Inspect web proxy, browser telemetry, and endpoint logs for repeated XMLHttpRequest attempts to non-standard protocol schemes from the same origin; correlate with known malicious domains if threat intelligence is available.

What your security team should do

• Prioritize immediate updates to Firefox 95+, ESR 91.4+, and Thunderbird 91.4+ across the fleet
• Monitor EPSS score and any new exploit publications given the 1779 days since disclosure
• Block or sandbox untrusted web content that performs extensive protocol probing
• Review browser telemetry and web logs for anomalous XMLHttpRequest patterns to external protocols