CVE-2022-34471

What it actually does

The browser fails to validate that the version of a downloaded addon update matches the version declared in the update manifest, permitting an attacker-controlled manifest to force installation of an arbitrarily older addon version.

Why it matters to the business

Older addon versions that contain known vulnerabilities or reduced security controls can be silently installed, increasing the chance of subsequent compromise of user data or browser integrity across the installed base.

How an attack unfolds

An attacker positions a tampered manifest on the update server or via network interception; when the browser requests an addon update it receives the altered manifest, downloads the older package, and installs it without version verification, resulting in a downgraded addon.

How to fix it

Upgrade all Firefox installations to version 102 or later; enable automatic updates and verify that installed addons are at their latest published versions after the upgrade.

How to confirm the fix worked

Confirm Firefox version is 102 or higher, review addon update logs for unexpected version changes, and periodically audit installed addon versions against the current manifest on addons.mozilla.org.

Typical attack path

1. Position a malicious or altered manifest on the addon update distribution path
2. Wait for or trigger an addon update check in an affected Firefox instance
3. Deliver a manifest that references an older addon package
4. Browser downloads and installs the older package without version check
5. Attacker leverages the downgraded addon for further exploitation

How to detect it

Examine browser update and addon installation logs for entries showing addon versions that decrease over time; correlate with network traffic to addon update endpoints around the time of the version change.

What your security team should do

• Prioritize deployment of Firefox 102+ across the environment
• Configure enterprise update policies to enforce automatic updates
• Monitor addon installation events for version regressions
• Review network controls that could allow manifest tampering