CVE-2022-31744

What it actually does

The flaw permits injection of arbitrary CSS rules into stylesheets loaded via internal URIs such as resource:, bypassing the page's Content Security Policy and allowing modification of rendered content or exfiltration via CSS-based side channels.

Why it matters to the business

Older browser and email client versions remain exposed to style injection that can alter page appearance, enable data leakage through CSS, or facilitate follow-on attacks; the issue is long-public with no known in-the-wild exploitation and low EPSS, reducing immediate urgency but still requiring upgrade of all affected Mozilla products.

How an attack unfolds

An attacker hosts or delivers a malicious page that references internal resource: URIs, injects crafted CSS rules that evade the CSP, and uses the resulting style changes to read cross-origin data or manipulate the user interface without triggering standard policy blocks.

How to fix it

Upgrade Firefox to 101 or later, Firefox ESR to 91.11 or later, and Thunderbird to 91.11 or 102 or later; enable automatic updates and verify installed versions against these thresholds.

How to confirm the fix worked

Query browser about:config or about:support pages and confirm version strings meet or exceed the fixed releases; test CSP-protected pages with resource: stylesheets to confirm injection is now blocked.

Typical attack path

1. Victim visits attacker-controlled page or receives malicious email in vulnerable Thunderbird
2. Page loads internal resource: stylesheet URI
3. Attacker-supplied CSS is injected into the stylesheet
4. CSP is bypassed allowing style-based data exfiltration or UI tampering
5. Attacker observes or acts on the resulting behavioral change

How to detect it

Review browser process logs, crash reports, and network telemetry for unexpected resource: stylesheet loads or anomalous CSS rule injections; correlate with user reports of altered page rendering on sites with strict CSP.

What your security team should do

• Prioritize patching all Firefox, Firefox ESR, and Thunderbird instances to the versions listed in remediation guidance
• Enforce enterprise update policies or deployment scripts to reach fixed versions within 30 days
• Review CSP implementations for defense-in-depth even after patching