CVE-2022-36315

What it actually does

Improper validation allows reuse of cached Subresource Integrity entries with mismatched metadata when loading scripts, bypassing intended integrity checks.

Why it matters to the business

Attackers with existing injection access could alter script behavior in affected browsers, resulting in limited tampering of web content without broader system compromise.

How an attack unfolds

An attacker with script injection capability crafts a page that loads a script using Subresource Integrity attributes, forcing the browser to reuse a prior cache entry that carries different integrity metadata and thereby evades the check.

How to fix it

Upgrade Mozilla Firefox to version 103 or later to enforce correct integrity validation against cached entries.

How to confirm the fix worked

Confirm browser version is at least 103; test SRI-protected script loads after clearing cache to verify metadata is revalidated on each load.

Typical attack path

1. Identify a site allowing script injection
2. Inject a script tag referencing an external resource with SRI integrity attribute
3. Trigger cache reuse of a previously loaded entry with mismatched metadata
4. Observe execution of the resource despite integrity mismatch

How to detect it

Examine browser cache and network logs for script loads that bypass expected integrity verification; review web server access logs for unusual script injection patterns around the affected versions.

What your security team should do

• Prioritize browser updates across all managed endpoints to Firefox 103+
• Review web applications for reliance on Subresource Integrity and ensure cache headers do not interfere with validation
• Monitor for future SRI-related updates in browser release notes