CVE-2022-22739

What it actually does

The flaw permits malicious websites to bypass user confirmation safeguards and launch external protocol handlers, resulting in execution of arbitrary programs chosen by the attacker.

Why it matters to the business

Attackers can execute programs on user systems without full consent, potentially leading to malware installation, data theft, or follow-on attacks across browser users in the organization.

How an attack unfolds

An attacker hosts a crafted webpage that registers or invokes a custom external URL protocol handler; when a victim visits the page the browser displays a deceptive prompt that, if accepted, directly executes attacker-chosen code outside the browser sandbox.

How to fix it

Upgrade Mozilla Firefox to version 96 or later, Firefox ESR to 91.5 or later, and Thunderbird to 91.5 or later. Apply vendor updates as soon as available and verify installed versions across all endpoints.

How to confirm the fix worked

Inventory browser and mail client versions using endpoint management tools; confirm no installations remain below the fixed thresholds and test that protocol-handler prompts no longer bypass intended safeguards.

Typical attack path

1. Victim navigates to attacker-controlled website
2. Page triggers external protocol handler prompt via specially formatted link
3. User is socially engineered into accepting the launch
4. Arbitrary program registered by the attacker executes on the endpoint

How to detect it

Review browser and operating-system logs for unexpected protocol handler launches originating from web content; correlate with web proxy records showing visits to previously unknown domains immediately preceding process-creation events.

What your security team should do

• Immediately deploy the listed browser and Thunderbird updates to all managed systems
• Configure automatic update policies to prevent future version drift
• Educate users on declining unexpected protocol handler prompts
• Monitor endpoint logs for anomalous external protocol invocations