CVE-2022-31736

What it actually does

The flaw permits a cross-origin resource size to be inferred by a malicious site through timing or response analysis of Range requests without triggering CORS restrictions.

Why it matters to the business

Organizations face increased risk of sensitive file or data size leakage that can support targeted follow-on attacks, with older browser deployments amplifying exposure across the user base.

How an attack unfolds

An attacker crafts a malicious webpage that issues cross-origin Range requests against a target resource; the browser's handling of partial responses leaks the total content length to the attacker without user interaction or authentication.

How to fix it

Upgrade Mozilla Firefox to version 101 or later, Firefox ESR to 91.10 or later, and Thunderbird to 91.10 or later. Enforce browser auto-update policies and verify version compliance across the environment.

How to confirm the fix worked

Confirm all instances report versions at or above the fixed releases; re-test cross-origin Range request behavior in a controlled lab environment after patching.

Typical attack path

1. Attacker hosts a webpage containing JavaScript that performs cross-origin Range requests
2. Victim user visits the malicious page while authenticated or able to reach the target resource
3. Script issues multiple Range requests and measures responses to calculate exact resource size
4. Attacker uses the disclosed size to fingerprint or locate sensitive content for further exploitation

How to detect it

Examine browser process logs, extension activity, and network request histories for repeated Range header usage from untrusted origins; correlate with known malicious domains if available.

What your security team should do

• Prioritize browser updates to the fixed versions within 30 days given the high CVSS and public disclosure
• Deploy enterprise update enforcement tools to ensure rapid rollout
• Review and harden CORS and resource access policies where possible