CVE-2022-36314

What it actually does

A crafted Windows shortcut file opened from the local filesystem can cause the browser to issue unexpected network requests to remote paths supplied by the attacker.

Why it matters to the business

Users on Windows may inadvertently trigger outbound network connections when opening local shortcut files, creating a risk of information leakage about internal network topology or enabling follow-on attacks with minimal user interaction.

How an attack unfolds

An attacker crafts a Windows shortcut pointing to a remote UNC path, delivers the file to a target user via email, download, or shared folder, and the victim opens it with an affected Firefox or Thunderbird build on Windows, resulting in the operating system making the remote request.

How to fix it

Upgrade Firefox to version 103 or later, Firefox ESR to 102.1 or later, and Thunderbird to 102.1 or later. Apply vendor updates as soon as they become available for all affected Windows installations.

How to confirm the fix worked

Verify installed product versions against the fixed releases listed above; confirm that opening test shortcut files no longer generates unexpected outbound network traffic to remote hosts.

Typical attack path

1. Craft malicious .lnk shortcut containing remote UNC path
2. Deliver file to victim via phishing, web download, or file share
3. Victim opens the shortcut from the local filesystem inside the browser
4. Browser triggers operating-system network request to attacker-controlled host

How to detect it

Review browser and system proxy logs for outbound connections triggered immediately after .lnk file access; correlate with file-open events for shortcut files in user directories or downloads folders.

What your security team should do

• Immediately deploy the listed browser and mail-client updates across the Windows fleet
• Harden email and web-download policies to block or sandbox .lnk attachments
• Monitor proxy and endpoint logs for unexpected outbound SMB or HTTP requests originating from browser processes