CVE-2022-29913

What it actually does

The parent process fails to validate whether the Speech Synthesis feature is enabled before accepting and acting on instructions received from a child process, allowing unauthorized execution of synthesis operations.

Why it matters to the business

Attackers can trigger unauthorized speech synthesis actions in the email client, potentially leading to integrity violations such as unwanted audio output or manipulation of user experience without user consent; the low EPSS and lack of known exploitation reduce immediate urgency but older unpatched versions remain exposed.

How an attack unfolds

An attacker crafts content that causes the Thunderbird child process to send synthesis instructions to the parent; because the parent skips the enabled check, the instructions execute regardless of feature settings, achieving the bypass.

How to fix it

Upgrade Thunderbird to version 91.9 or later; verify the Speech Synthesis feature configuration after update and monitor for any related process behavior changes.

How to confirm the fix worked

Confirm the installed version is 91.9 or newer; test that synthesis instructions from child processes are rejected when the feature is disabled; review release notes for the fix.

Typical attack path

1. Deliver malicious email or content to a Thunderbird user
2. Trigger child process communication containing synthesis instructions
3. Parent process accepts and executes instructions without checking feature enablement
4. Achieve unauthorized synthesis actions

How to detect it

Review application logs for unexpected speech synthesis activity or child-to-parent process communications; examine Thunderbird process trees and feature state changes around the time of suspected incidents.

What your security team should do

• Prioritize updating all Thunderbird instances to 91.9 or later
• Audit configurations for the Speech Synthesis feature across the environment
• Monitor vendor advisories for any follow-on updates