CVE-2022-36318

What it actually does

Parameters supplied to chrome:// directory listings are reflected when those listings are rendered as source text, enabling unauthorized confidentiality exposure via a race condition in affected Mozilla products.

Why it matters to the business

Older browser and email client installations may leak sensitive internal parameters to remote attackers, increasing risk of data exposure for users who have not applied updates over the past three years.

How an attack unfolds

An attacker prepares a malicious page that triggers a visit to a chrome:// directory listing, supplies crafted parameters, and relies on the reflection behavior combined with a race condition to capture reflected data when the user views the listing as source text.

How to fix it

Upgrade Mozilla Firefox to version 103 or later, Firefox ESR to 102.1 or later (or 91.12 or later for the 91 branch), and Thunderbird to 102.1 or later (or 91.12 or later for the 91 branch).

How to confirm the fix worked

Verify installed product versions against the fixed releases listed above; re-test chrome:// directory listings with reflected parameters to confirm reflection no longer occurs.

Typical attack path

1. Craft a web page containing a link or script that navigates the victim browser to a chrome:// directory listing URL containing attacker-controlled parameters
2. Induce the victim to load the page and view the directory listing as source text
3. Exploit the race condition timing to observe the reflected parameters and exfiltrate the resulting data

How to detect it

Review browser history and extension logs for unexpected chrome:// directory listing accesses; correlate with network logs for data exfiltration attempts immediately following such visits.

What your security team should do

• Immediately deploy the version upgrades noted in remediation guidance across all managed endpoints
• Prioritize inventory scans for any remaining instances of Firefox ESR < 102.1, Firefox < 103, or Thunderbird < 102.1
• Monitor EPSS trend and revisit patch status if exploit maturity increases