CVE-2022-42927

What it actually does

Same-origin policy violation allowing theft of cross-origin URL entries via performance.getEntries(), leaking redirect results.

Why it matters to the business

Attackers could access sensitive navigation data across sites, risking exposure of private URLs and user activity with low exploitation likelihood but high potential data leakage impact.

How an attack unfolds

An attacker lures a victim to a malicious page that triggers a cross-origin redirect and then reads the resulting URL entries through performance.getEntries() to exfiltrate the leaked redirect target.

How to fix it

Upgrade affected Firefox installations to version 106 or later, ESR to 102.4 or later, and Thunderbird to 102.4 or later. For tensorflow/tensorflow (GIT) apply the fix in commit 61f0f9b94df8c0411f0ad0ecc2fec2d3f3c33555.

How to confirm the fix worked

Confirm browser and Thunderbird versions meet or exceed the fixed releases; verify tensorflow/tensorflow (GIT) is at commit 61f0f9b94df8c0411f0ad0ecc2fec2d3f3c33555 or newer; test that performance.getEntries() no longer exposes cross-origin redirect URLs.

Typical attack path

1. Host a malicious webpage that initiates a cross-origin navigation
2. Force a redirect to a sensitive cross-origin resource
3. Invoke performance.getEntries() to capture the leaked URL
4. Exfiltrate the obtained redirect information to an attacker-controlled server

How to detect it

Review web server and browser logs for unusual performance.getEntries() calls originating from untrusted domains; inspect network traffic for exfiltration of redirect URLs after cross-origin navigations.

What your security team should do

• Prioritize patching browsers and Thunderbird within standard maintenance windows given the three-year-old disclosure and low EPSS
• Audit web applications for reliance on performance timing APIs and add additional origin checks where redirects occur
• Monitor for any future EPSS increases or exploit maturity changes