CVE-2022-40959

What it actually does

During iframe navigation, FeaturePolicy is not fully initialized on certain pages, allowing a bypass that exposes device permissions (such as camera or microphone access) to untrusted subdocuments.

Why it matters to the business

Attackers can obtain unauthorized access to user device capabilities from malicious web content, increasing risk of privacy breaches and potential follow-on attacks across browser users in an organization.

How an attack unfolds

An attacker hosts or compromises a site that loads target pages inside iframes and performs specific navigation sequences to trigger incomplete FeaturePolicy initialization, causing permission grants to leak into attacker-controlled subdocuments.

How to fix it

Upgrade Mozilla Firefox to version 105 or later, Firefox ESR to 102.3 or later, and Thunderbird to 102.3 or later. Apply updates through official channels as soon as possible given the age of the disclosure.

How to confirm the fix worked

Confirm browser versions meet or exceed the fixed releases listed in remediation; test iframe navigation scenarios with permission prompts on patched builds to verify FeaturePolicy enforcement.

Typical attack path

1. Victim visits attacker-controlled or compromised website
2. Site embeds target pages in iframes and triggers navigation events
3. Incomplete FeaturePolicy initialization occurs on the affected browser
4. Device permissions intended for trusted origins are exposed to untrusted subdocuments
5. Attacker exfiltrates or abuses leaked permissions for further actions

How to detect it

Review browser process logs, extension activity, and network requests for unexpected permission grants or iframe navigation patterns originating from untrusted domains; no public exploitation artifacts are known.

What your security team should do

• Prioritize immediate deployment of browser and Thunderbird updates across all endpoints
• Monitor vendor advisories for any additional related fixes
• Educate users on avoiding untrusted sites until patches are applied
• Review endpoint management policies to enforce automatic browser updates