CVE-2022-42929

What it actually does

A specially crafted call to window.print() triggers a browser denial of service that can survive restart depending on session restore configuration.

Why it matters to the business

Affected users experience repeated browser unresponsiveness or crashes that interrupt daily work and may require profile or session cleanup to resolve.

How an attack unfolds

An attacker hosts a page that invokes window.print() in the triggering pattern; a victim visits the page and the browser enters a persistent DoS state.

How to fix it

Upgrade Firefox to 106 or later, Firefox ESR to 102.4 or later, and Thunderbird to 102.4 or later.

How to confirm the fix worked

Verify installed browser versions meet or exceed the fixed releases and confirm window.print() calls no longer produce persistent unresponsiveness.

Typical attack path

1. Host malicious webpage containing crafted window.print() invocation
2. Lure user to visit the page
3. Browser enters unresponsive state that may persist across restarts

How to detect it

Review browser crash logs and user reports of sudden unresponsiveness after visiting external sites; correlate with known malicious domains if available.

What your security team should do

• Prioritize browser and email client updates across the fleet
• Disable automatic session restore where feasible until patches are deployed
• Communicate update urgency to end users given the low-effort attack vector