CVE-2022-28283

What it actually does

Missing security checks on sourceMapURL in devtools permit a webpage to specify arbitrary local or remote file paths, resulting in unauthorized file reads via path traversal.

Why it matters to the business

Attackers can obtain sensitive local files such as configuration data or credentials from users who visit malicious pages, increasing risk of data exposure and downstream compromise across the Firefox user base.

How an attack unfolds

An attacker hosts a page that references a crafted source map URL pointing to file:// or other restricted locations; when a victim loads the page with developer tools active, the browser follows the unvalidated URL and returns the targeted file contents to the attacker-controlled page.

How to fix it

Upgrade Mozilla Firefox to version 99 or later to enforce proper security checks on sourceMapURL references.

How to confirm the fix worked

Verify installed Firefox version is 99 or newer; attempt to load a test page with a sourceMapURL referencing a local file and confirm the request is blocked.

Typical attack path

1. Attacker crafts webpage embedding malicious sourceMapURL
2. Victim visits the page while Firefox developer tools are enabled
3. Browser resolves the unvalidated source map path to a local or protected file
4. File contents are retrieved and exfiltrated to the attacker

How to detect it

Review browser process logs and network captures for unexpected file:// or local path references originating from web content; inspect developer tools console or network activity for source map loads from non-standard origins.

What your security team should do

• Prioritize deployment of Firefox 99+ across all managed endpoints
• Monitor for users on versions prior to 99 and enforce updates via enterprise policy
• Review browser extension and developer tool usage policies to limit exposure