CVE-2022-34473

What it actually does

The HTML sanitizer fails to sanitize xlink:href attributes on SVG <use> tags, permitting unsanitized URIs to reach the rendering engine and trigger script execution in the page context.

Why it matters to the business

Unpatched older Firefox versions can be tricked into running attacker-controlled code when users visit malicious pages, creating risk of credential theft or session hijacking; the issue is long-public with negligible observed exploitation activity.

How an attack unfolds

An attacker embeds an SVG <use> element whose xlink:href attribute references a javascript: or data: URI containing executable code; because the sanitizer skips this attribute, the payload survives sanitization and executes when the page renders in vulnerable Firefox.

How to fix it

Upgrade Mozilla Firefox to version 102 or newer; re-test any custom sanitization logic that processes SVG content.

How to confirm the fix worked

Confirm installed Firefox version is 102 or later; attempt to render test SVG content containing xlink:href attributes and verify the attribute is stripped or neutralized.

Typical attack path

1. Prepare web content containing an SVG <use> tag with a malicious xlink:href value
2. Host or inject the content on a site the victim will visit
3. Victim loads the page in an affected Firefox release
4. Unsanitized attribute triggers script execution within the page origin

How to detect it

Inspect web-proxy or browser telemetry logs for SVG content carrying xlink:href attributes that reference javascript or data schemes; correlate with unusual script execution originating from SVG elements.

What your security team should do

• Ensure all Firefox deployments are at version 102 or newer
• Include browser version checks in endpoint compliance scans
• Review any internal web applications that accept or render user-supplied SVG for similar sanitization gaps