CVE-2022-31742

What it actually does

A timing side-channel in WebAuthn allowCredential handling permits an attacker to distinguish invalid key handles from cross-origin key handles by measuring response latency differences when submitting large numbers of entries, enabling cross-origin account linking.

Why it matters to the business

Attackers could correlate user identities across unrelated websites, eroding privacy protections and potentially enabling targeted phishing or account takeover; the issue has been public for nearly four years with no known exploitation campaigns.

How an attack unfolds

An attacker serves a malicious page that triggers WebAuthn authentication requests containing many allowCredential entries, times the browser responses to identify valid cross-origin handles, and uses the information to link accounts across origins in violation of WebAuthn isolation goals.

How to fix it

Upgrade Mozilla Firefox to 101 or later, Firefox ESR to 91.10 or later, and Thunderbird to 91.10 or later; ensure all installations receive the updates promptly given the multi-year disclosure window.

How to confirm the fix worked

Confirm installed versions meet or exceed Firefox 101, Firefox ESR 91.10, and Thunderbird 91.10; perform WebAuthn tests with mixed invalid and cross-origin credentials to verify uniform response timing.

Typical attack path

1. Serve malicious webpage to victim
2. Trigger repeated WebAuthn authentication flows
3. Submit large allowCredential lists in each request
4. Measure timing differences between responses
5. Infer presence of cross-origin key handles
6. Correlate accounts across origins

How to detect it

Audit browser version inventories for pre-fix releases; inspect web logs for WebAuthn requests containing unusually high numbers of allowCredential entries, though the timing-based nature makes post-exploitation artifacts scarce.

What your security team should do

• Apply browser and Thunderbird updates across the environment immediately
• Review update policies to prevent future multi-year exposure windows
• Monitor threat intelligence feeds for any late-emerging exploit activity