CVE-2022-38472

What it actually does

XSLT error handling flaw allows attacker-controlled content to be associated with a different origin and displayed in the address bar, enabling origin spoofing for data submission.

Why it matters to the business

Users may submit sensitive information to spoofed origins, increasing risk of credential theft and data loss across widely deployed browser environments with low but ongoing exposure due to slow patching.

How an attack unfolds

An attacker serves a malicious page leveraging XSLT processing errors to spoof a trusted origin in the address bar, tricking the user into interacting with attacker content as if it were legitimate.

How to fix it

Upgrade Mozilla Firefox to version 104 or later, Firefox ESR to 91.13 or 102.2 or later, and Thunderbird to 91.13 or 102.2 or later. Apply updates across all managed endpoints and verify version compliance.

How to confirm the fix worked

Confirm installed browser versions meet or exceed the fixed releases listed in vendor advisories and test address bar behavior against known XSLT error patterns in a controlled environment.

Typical attack path

1. Host a malicious page containing crafted XSLT that triggers error handling
2. Associate attacker content with a spoofed origin via the flaw
3. Display the spoofed origin in the browser address bar
4. Induce the user to submit credentials or data to the attacker-controlled content

How to detect it

Review browser history, extension logs, and network traffic for unexpected XSLT-related content or repeated visits to domains that could leverage address bar spoofing; correlate with user reports of suspicious address bar behavior.

What your security team should do

• Prioritize browser updates on all systems within the next patching cycle
• Enforce automatic updates where possible and audit for outdated instances
• Educate users on verifying origins before submitting data
• Monitor EPSS and threat intelligence for any increase in exploitation activity