CVE-2022-22761

What it actually does

The flaw permits arbitrary web origins to embed moz-extension:// pages in frames or iframes by ignoring the frame-ancestors directive declared in an extension's Content Security Policy, bypassing intended origin restrictions on extension resources.

Why it matters to the business

Organizations relying on Firefox, Firefox ESR, or Thunderbird face elevated risk of unauthorized access to extension data and functionality, which can lead to credential theft, privacy breaches, or unauthorized actions performed through trusted extensions.

How an attack unfolds

An attacker creates a malicious webpage containing an iframe that targets a web-accessible resource of a vulnerable extension. Because frame-ancestors is not enforced, the browser loads the extension page inside the attacker's frame, allowing script or content interaction that would otherwise be blocked by CSP, ultimately enabling data exfiltration or abuse of extension privileges.

How to fix it

Upgrade Firefox to 97 or later, Firefox ESR to 91.6 or later, and Thunderbird to 91.6 or later; audit installed extensions to ensure they declare an appropriate frame-ancestors directive and remove or replace any extensions that cannot be updated.

How to confirm the fix worked

Confirm installed versions meet or exceed the fixed releases, then test that a sample extension page with frame-ancestors CSP correctly rejects framing attempts from unauthorized origins.

Typical attack path

1. Locate a target extension exposing web-accessible pages under moz-extension://
2. Host attacker-controlled content that loads the extension resource inside an iframe or frame
3. Exploit missing frame-ancestors enforcement to render the extension page despite CSP
4. Interact with the framed extension content to read or manipulate sensitive data or perform privileged actions

How to detect it

Examine endpoint inventory and browser version logs for installations older than the fixed releases; review web proxy or browser telemetry for unexpected framing or navigation events involving moz-extension:// URLs from external origins.

What your security team should do

• Apply the listed version upgrades immediately across all endpoints
• Inventory and update all Mozilla-based applications and extensions
• Enable automatic updates where possible and establish a recurring patch cadence
• Review extension permissions and CSP configurations for high-risk deployments