CVE-2022-22748

What it actually does

The flaw permits malicious websites to spoof the displayed origin in prompts for launching external URL protocol handlers due to improper input validation of origins in Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.

Why it matters to the business

Users on affected Debian systems may be tricked into executing unintended external programs, increasing risk of malware infection or unauthorized actions on endpoints; low EPSS and no KEV status indicate limited active exploitation but remediation remains necessary given available exploits and widespread browser use.

How an attack unfolds

An attacker hosts a malicious site that leverages the origin confusion to present a trusted domain when Firefox or Thunderbird prompts for an external protocol handler, leading the user to approve execution of an attacker-controlled payload.

How to fix it

Upgrade Firefox to 96+, ESR to 91.5+, Thunderbird to 91.5+; on Debian 11 apply packages fixed in 5.10.158-1, on Debian 12/13 apply packages fixed in 6.0.10-1.

How to confirm the fix worked

Confirm installed browser versions match or exceed the fixed releases via about:support or package manager queries; test protocol handler prompts on known malicious test pages to verify correct origin display.

Typical attack path

1. Host a crafted webpage exploiting origin spoofing for external protocol prompts
2. Entice user to visit the page in a vulnerable browser version
3. Trigger the protocol launch prompt with falsified origin
4. Obtain user approval for handler execution
5. Execute attacker-supplied external program or payload

How to detect it

Examine browser history, download logs, and system event logs for unexpected external protocol handler invocations following visits to untrusted sites; correlate with any post-2022-12-22 activity on vulnerable versions.

What your security team should do

• Immediately apply the listed fixed package versions across all Debian 11/12/13 instances
• Disable unnecessary external protocol handlers where feasible
• Monitor EPSS trends and exploit availability for prioritization of browser updates