CVE-2022-22760

What it actually does

Error messages during Web Worker resource imports distinguish application/javascript responses from non-script responses, enabling cross-origin information leakage.

Why it matters to the business

Attackers may extract sensitive cross-origin data such as internal application structure or user-related information, increasing privacy and compliance risks across browser-dependent environments.

How an attack unfolds

An attacker hosts a malicious page that triggers Web Worker imports against a target origin and inspects error message variations to determine whether responses contain scripts, thereby learning otherwise inaccessible cross-origin details.

How to fix it

Upgrade gpac/gpac (GIT) to commit 77510778516803b7f7402d7423c6d6bef50254c3 or later; apply equivalent updates for any affected Mozilla products to versions Firefox 97, Thunderbird 91.6, or Firefox ESR 91.6 and above.

How to confirm the fix worked

Verify installed versions or source commits against the fixed commit hash; test Web Worker import behavior to confirm error messages no longer differentiate response types.

Typical attack path

1. Host malicious page controlling Web Workers
2. Trigger cross-origin resource imports via worker scripts
3. Observe distinguishable error messages for script versus non-script responses
4. Infer and exfiltrate cross-origin information

How to detect it

Search browser and application logs for Web Worker import attempts accompanied by repeated cross-origin requests; correlate with unusual error patterns or information exfiltration attempts.

What your security team should do

• Prioritize patching gpac and Mozilla products within 30 days given publication age and steady EPSS
• Review web-facing applications for reliance on cross-origin worker imports
• Update browser and multimedia framework inventories across the environment