CVE-2022-29909

What it actually does

A flaw in permission handling allows documents in deeply nested cross-origin browsing contexts to inherit permissions granted to the top-level origin without triggering the expected user prompt.

Why it matters to the business

Attackers can obtain unauthorized access to user-granted permissions such as camera, microphone or location, enabling data theft or unauthorized actions within browser sessions and increasing risk of privacy violations or account compromise.

How an attack unfolds

An attacker hosts a page containing multiple levels of cross-origin iframes that are loaded by a victim; the nested frames exploit the inheritance bug to obtain permissions already granted to the top-level site without additional user interaction.

How to fix it

Upgrade Mozilla Firefox to 100 or later, Firefox ESR to 91.9 or later, and Thunderbird to 91.9 or later.

How to confirm the fix worked

Confirm installed browser versions meet or exceed the fixed releases and verify that permission prompts are correctly shown for cross-origin nested contexts.

Typical attack path

1. Attacker prepares a page with deeply nested cross-origin iframes
2. Victim is lured to the attacker-controlled page via phishing or malicious link
3. Browser incorrectly propagates top-level permissions to the nested frames
4. Attacker performs actions requiring those permissions without prompting the user

How to detect it

Review browser history and extension logs for visits to suspicious cross-origin heavy pages; examine permission request events in browser telemetry or enterprise logging solutions for unexpected grants.

What your security team should do

• Apply browser updates immediately across all managed endpoints
• Block or monitor traffic to known malicious domains that may host exploit pages
• Review and restrict unnecessary web permissions in enterprise browser policies