CVE-2022-22757

What it actually does

The Remote Agent component used by WebDriver fails to validate Host or Origin headers on incoming connections, permitting unauthorized cross-origin requests from websites to localhost that can seize control of the browser instance.

Why it matters to the business

When WebDriver is explicitly enabled, organizations risk limited browser session takeover from malicious sites, which could expose user actions or data; however the non-default configuration and low exploit probability keep overall operational exposure minimal.

How an attack unfolds

An attacker hosts a webpage that, when loaded in a Firefox instance running WebDriver, issues a connection to the local Remote Agent endpoint; because header validation is absent the agent accepts the request and grants the attacker the ability to drive browser actions.

How to fix it

Upgrade Mozilla Firefox to version 97 or later; disable the Remote Agent / WebDriver feature when it is not required for testing or automation.

How to confirm the fix worked

Confirm the installed Firefox version is 97 or newer; attempt to connect to the Remote Agent from an external origin and verify that requests lacking valid Host or Origin headers are rejected.

Typical attack path

1. User has Firefox with WebDriver enabled and visits attacker-controlled site
2. Malicious page issues HTTP request to localhost Remote Agent endpoint
3. Missing Host/Origin checks allow the connection to succeed
4. Attacker issues WebDriver commands to control the browser session

How to detect it

Inspect browser process logs and network activity for unexpected localhost connections initiated by web content; look for WebDriver command traffic originating from non-local sources.

What your security team should do

• Disable WebDriver / Remote Agent unless explicitly needed
• Upgrade all Firefox installations to 97 or later
• Include browser version checks in endpoint compliance scans