CVE-2022-26382

What it actually does

Side-channel attack on autofill tooltip text rendered with page-controlled fonts allows inference of displayed text content without direct JavaScript access.

Why it matters to the business

Potential leakage of sensitive user data such as credentials or personal information entered into web forms, increasing privacy and compliance risks across browser deployments.

How an attack unfolds

An attacker hosts a malicious page that loads specially crafted fonts, triggers autofill tooltips in the victim's Firefox browser, and uses timing or rendering side-channels to infer the tooltip text; public exploit code is available for this information disclosure.

How to fix it

Upgrade Mozilla Firefox to version 98 or later where the font rendering path for autofill tooltips was hardened.

How to confirm the fix worked

Verify installed Firefox version is 98 or higher; confirm that autofill tooltips no longer render using arbitrary page fonts by testing with crafted font payloads.

Typical attack path

1. Host a webpage embedding attacker-controlled fonts
2. Induce autofill tooltip display via form interaction
3. Measure rendering or timing differences caused by font glyphs
4. Reconstruct sensitive autofill text from side-channel observations

How to detect it

Monitor browser telemetry or endpoint logs for unusual font loading patterns on pages that trigger autofill; review any reported exploit usage against Firefox versions prior to 98.

What your security team should do

• Prioritize immediate update of all Firefox instances to version 98 or newer
• Enable automatic browser updates across the environment
• Review web application form handling to reduce reliance on autofill for high-value data