CVE-2022-29915

What it actually does

The Performance API exposed whether cross-origin resource requests had followed redirects, leaking redirect metadata that should have been hidden.

Why it matters to the business

Attackers can obtain extra details about how users navigate to third-party sites, increasing the risk of targeted tracking or reconnaissance against Firefox users on older versions.

How an attack unfolds

An attacker crafts a page that loads cross-origin resources via the Performance API and inspects timing or entry data to determine if redirects occurred, revealing navigation or resource behavior that should remain private.

How to fix it

Upgrade all Firefox installations to version 100 or later to enforce proper hiding of redirect information in the Performance API.

How to confirm the fix worked

Confirm Firefox version is 100 or newer and test that Performance API entries for cross-origin redirected resources no longer expose redirect metadata.

Typical attack path

1. Serve malicious web content to a Firefox user on version < 100
2. Trigger loading of cross-origin resources that may involve redirects
3. Query the Performance API from attacker-controlled JavaScript
4. Inspect redirect-related entries or timing to infer private navigation details

How to detect it

Review web server or proxy logs for unusual patterns of cross-origin resource requests followed by JavaScript execution that accesses performance timing data; no specific post-exploitation artifacts are typically observable on the client.

What your security team should do

• Prioritize updating Firefox deployments to version 100+ within standard patch cycles
• Monitor browser update compliance reports across the organization
• Review web application code that relies on Performance API data for any assumptions about redirect visibility