CVE-2022-28286

What it actually does

Due to a layout change, iframe contents could render outside the element's border, allowing visual spoofing of UI elements.

Why it matters to the business

Attackers could deceive users into interacting with malicious content presented as legitimate browser UI, increasing phishing risk across browser users; the issue affects widely deployed products but has low exploit probability.

How an attack unfolds

An attacker crafts a web page containing an iframe whose contents are positioned to overflow its borders and appear as part of trusted browser chrome or another site's interface, then lures a victim to the page to induce mistaken actions.

How to fix it

Upgrade Mozilla Firefox to version 99 or later, Firefox ESR to 91.8 or later, and Thunderbird to 91.8 or later.

How to confirm the fix worked

Verify installed browser and Thunderbird versions meet or exceed the fixed releases; test iframe rendering behavior on sample pages that previously triggered overflow.

Typical attack path

1. Craft a malicious webpage embedding an overflowing iframe
2. Host the page on an attacker-controlled or compromised domain
3. Deliver a link via phishing email or malicious advertisement
4. Victim visits the page and interacts with spoofed content

How to detect it

Review web proxy or browser history logs for visits to suspicious domains; examine user reports of unexpected UI elements; no reliable post-exploitation artifacts are typically available for this visual-only issue.

What your security team should do

• Prioritize patching all Mozilla Firefox, ESR, and Thunderbird instances to the fixed versions
• Block or filter known malicious domains used in phishing campaigns
• Enable automatic updates where possible and audit endpoint browser versions