CVE-2022-36319

What it actually does

A CSS rendering flaw where overflow combined with transform properties causes the mouse cursor to register interactions at coordinates that differ from the visually displayed content, enabling mismatched hit-testing.

Why it matters to the business

Attackers can trick users into performing unintended actions such as submitting forms or clicking buttons that appear elsewhere, potentially leading to data exposure or unauthorized account changes across browser users.

How an attack unfolds

An attacker hosts a specially crafted web page using targeted CSS overflow and transform rules that misalign cursor hit areas, then lures victims to the page where normal mouse interactions execute actions against hidden or offset elements.

How to fix it

Upgrade Mozilla Firefox to version 103 or later, Firefox ESR to 102.1 or later, and Thunderbird to 102.1 or later. Apply updates through the browser's built-in update mechanism or enterprise deployment channels.

How to confirm the fix worked

Verify installed browser versions meet or exceed the fixed releases listed in the advisory and test affected CSS properties in a controlled environment to confirm coordinate alignment behaves as expected.

Typical attack path

1. Craft a malicious page with specific CSS overflow and transform combinations
2. Host the page on an attacker-controlled domain
3. Use phishing or other social engineering to drive browser users to the page
4. Capture or trigger unintended user interactions via the coordinate mismatch

How to detect it

Examine browser history and proxy logs for visits to domains not on approved lists; inspect rendered pages for unusual overflow or transform CSS usage in forensic analysis of suspect sessions.

What your security team should do

• Prioritize browser updates across all endpoints within the next 48 hours
• Enforce automatic updates via enterprise policy where possible
• Review web proxy or endpoint logs for access to untrusted domains hosting unusual CSS patterns
• Educate users on verifying browser version and avoiding suspicious links