CVE-2022-34474

What it actually does

A sandboxed iframe using allow-top-navigation-by-user-activation could bypass restrictions when receiving a redirect header to an external protocol, allowing the browser to process the redirect and prompt the user.

Why it matters to the business

Attackers may redirect users to malicious external handlers or sites, increasing phishing risk and potential exposure of user data or credentials.

How an attack unfolds

An attacker embeds a sandboxed iframe in a malicious page configured to issue a redirect header targeting an external protocol; when a user visits the page the browser follows the redirect despite sandbox rules.

How to fix it

Upgrade Firefox to version 102 or later; for ikus060/rdiffweb update to commit 9125f5a2d918fed0f3fc1c86fa94cd1779ed9f73.

How to confirm the fix worked

Verify Firefox version is at least 102; test sandboxed iframe behavior with external protocol redirects to confirm restriction enforcement.

Typical attack path

1. Host malicious page containing sandboxed iframe with allow-top-navigation-by-user-activation
2. Configure server to return redirect header to external protocol
3. Lure user to visit the attacker page
4. Browser processes redirect and prompts user for external handler

How to detect it

Review web proxy and browser logs for unexpected redirects from sandboxed frames to external protocols such as mailto or custom handlers.

What your security team should do

• Prioritize browser updates across all endpoints
• Review web applications embedding iframes for sandbox attribute usage
• Enable enterprise browser management policies to enforce minimum versions