CVE-2022-29916

What it actually does

The browser's handling of CSS resources that reference already-known resources via CSS variables produces observable behavioral differences that allow an attacker-controlled page to infer whether specific URLs exist in the user's history.

Why it matters to the business

Attackers can silently learn which sites a user has previously visited, exposing sensitive browsing patterns that may reveal personal interests, medical conditions, or corporate research and enabling more targeted phishing or social-engineering attacks.

How an attack unfolds

An attacker hosts a malicious page that loads crafted CSS using variables to reference external resources. Because the browser treats cached (history-known) versus uncached resources differently, timing or rendering side-effects reveal visited URLs; the collected history data is exfiltrated to the attacker. Public exploit code has been available since disclosure.

How to fix it

Upgrade Mozilla Firefox to 100 or later, Firefox ESR to 91.9 or later, and Thunderbird to 91.9 or later. After patching, clear browser history if prior exposure is suspected.

How to confirm the fix worked

Confirm installed browser versions meet or exceed the fixed releases; re-test with publicly available history-sniffing CSS proofs-of-concept to verify that observable differences no longer occur.

Typical attack path

1. Attacker prepares a web page containing malicious CSS that references target URLs via variables
2. Victim is lured to the attacker's page
3. Page measures behavioral differences during CSS loading to determine which target URLs are in history
4. Results are sent back to the attacker server
5. Attacker uses inferred history for follow-on attacks

How to detect it

Examine web-proxy and browser telemetry logs for repeated cross-origin CSS requests containing variable references to external domains; correlate with known malicious domains that have hosted history-probing pages since disclosure.

What your security team should do

• Immediately deploy the listed fixed browser versions across all endpoints
• Block or warn on access to untrusted sites that load external CSS variables until patching is complete
• Review browser telemetry and proxy logs for anomalous cross-origin CSS requests that may indicate attempted probing