CVE-2022-22745

What it actually does

SecurityPolicyViolation events leak cross-origin information when frame-ancestors directives are violated in affected browsers.

Why it matters to the business

Attackers may obtain sensitive cross-origin data from users, increasing privacy risks and potential for targeted follow-on attacks across browser users in the organization.

How an attack unfolds

An attacker hosts a page that triggers a frame-ancestors violation, causes the victim browser to dispatch a SecurityPolicyViolation event, and reads the leaked cross-origin details from the event object.

How to fix it

Upgrade Mozilla Firefox to version 96 or later, Firefox ESR to 91.5 or later, and Thunderbird to 91.5 or later. Apply updates as soon as they become available through official channels.

How to confirm the fix worked

Verify installed browser versions against the fixed releases; confirm absence of the issue by testing that SecurityPolicyViolation events no longer expose cross-origin frame-ancestors details.

Typical attack path

1. Craft a malicious page that embeds or is embedded in a way that violates the victim's frame-ancestors policy
2. Induce the victim to load the page (via phishing, malicious link, or compromised site)
3. Capture the resulting SecurityPolicyViolation event and extract the leaked cross-origin information
4. Use the obtained data to perform further reconnaissance or attacks

How to detect it

Review browser console logs and security policy violation reports for unexpected cross-origin frame-ancestors events; correlate with user navigation to suspicious domains.

What your security team should do

• Prioritize browser updates for all endpoints running affected Firefox, ESR, and Thunderbird versions
• Monitor EPSS trend and re-evaluate if exploit maturity increases
• Enforce enterprise browser update policies and block execution of unsupported versions