CVE-2022-28284

What it actually does

The SVG <use> element in Gecko-based browsers could load unexpected external content that executes script in the context of the embedding page, bypassing expected script security boundaries relied upon by web developers.

Why it matters to the business

Attackers can execute arbitrary code inside a user's browser session, enabling theft of credentials, session hijacking, or unauthorized actions on web applications visited by affected users; the high prevalence of Firefox deployments increases organizational exposure until patches are applied.

How an attack unfolds

An attacker hosts or injects a malicious web page containing a crafted SVG document that uses the <use> element to reference external content; when a victim loads the page in an unpatched Firefox version, the unexpected content executes script, achieving cross-site scripting without requiring user interaction beyond visiting the page.

How to fix it

Upgrade all instances of Mozilla Firefox to version 99 or later. Where immediate upgrades are not possible, enforce strict Content-Security-Policy headers that disallow inline scripts and restrict external resource loading on internal web applications.

How to confirm the fix worked

Confirm Firefox version 99 or newer is installed across the fleet; test affected web applications with a proof-of-concept SVG <use> payload in a lab environment to verify script execution is blocked; review browser release notes for the alignment change.

Typical attack path

1. Attacker crafts malicious SVG referencing unexpected content via the <use> element
2. Attacker delivers the SVG through a compromised or attacker-controlled website
3. Victim visits the page using vulnerable Firefox < 99
4. Browser loads and executes the injected script in the page origin
5. Attacker gains control over the victim's browsing context for data exfiltration or further attacks

How to detect it

Review web proxy or browser telemetry logs for access to pages containing unusual SVG <use> references; examine endpoint process execution for Firefox instances loading unexpected external resources; check for post-exploitation artifacts such as unauthorized script activity in browser developer tools or security logs.

What your security team should do

• Prioritize patching Firefox fleet-wide within the next 30 days given the public disclosure and potential for easy exploitation via web content
• Deploy or strengthen Content-Security-Policy on all internal and customer-facing web applications to mitigate similar client-side script injection risks
• Monitor browser telemetry and update compliance dashboards for continued presence of versions below 99
• Educate web developers on testing cross-browser SVG behavior during security reviews