CVE-2022-38473

What it actually does

A cross-origin iframe referencing an XSLT document inherits the parent domain's permissions such as microphone or camera access, bypassing same-origin policy checks for permission grants.

Why it matters to the business

Attackers can gain unauthorized access to sensitive device features like cameras and microphones on user systems running vulnerable browser versions, increasing risk of privacy violations and data exposure across large user bases.

How an attack unfolds

An attacker hosts a malicious page containing a cross-origin iframe that loads an XSLT stylesheet; when the victim visits the page, the iframe inherits the parent origin's permissions allowing access to camera or microphone without explicit user consent for the child origin.

How to fix it

Upgrade Mozilla Firefox to version 104 or later, Firefox ESR to 91.13 or 102.2 or later, and Thunderbird to 91.13 or 102.2 or later.

How to confirm the fix worked

Verify installed browser and email client versions against the fixed releases listed in vendor advisories; retest permission prompts on cross-origin iframes with XSLT references.

Typical attack path

1. Craft a web page with a cross-origin iframe referencing a controlled XSLT document.
2. Host the page on an attacker-controlled domain.
3. Lure the victim to visit the page while running a vulnerable browser version.
4. Trigger permission inheritance to access microphone or camera resources.
5. Capture or exfiltrate audio/video data.

How to detect it

Review browser permission logs and history for unexpected grants to camera or microphone from cross-origin contexts; examine network traffic for unusual media data exfiltration patterns after visiting untrusted sites.

What your security team should do

• Prioritize patching all instances of Firefox, Firefox ESR, and Thunderbird to the fixed versions.
• Monitor EPSS and exploit maturity indicators for any future increase in risk.
• Enforce browser auto-update policies across the organization.
• Review and restrict web permission grants for camera and microphone in enterprise browser configurations.