CVE-2022-42930

What it actually does

Data race in ThirdPartyUtil when two Workers simultaneously initialize CacheStorage, potentially leading to memory corruption or inconsistent state.

Why it matters to the business

Risk of browser instability or exploitation in environments using affected versions; low exploit likelihood but requires prompt patching due to 1395 days since publication and repeated dependency exposure in tensorflow/tensorflow ecosystem.

How an attack unfolds

An attacker would need to trigger concurrent Worker initialization of CacheStorage in a browser context to hit the race condition in ThirdPartyUtil; no known threat actors or ransomware use reported.

How to fix it

Upgrade affected Firefox installations to version 106 or later; for tensorflow/tensorflow (GIT) apply the fix in commit bce3717eaef4f769019fd18e990464ca4a2efeea.

How to confirm the fix worked

Confirm browser version is at least 106; verify tensorflow/tensorflow commit is bce3717eaef4f769019fd18e990464ca4a2efeea or newer; test concurrent Worker cache initialization scenarios.

Typical attack path

1. Craft web content that spawns multiple Workers
2. Force simultaneous CacheStorage initialization
3. Trigger data race in ThirdPartyUtil to corrupt state or leak data

How to detect it

Review browser process logs and crash reports for ThirdPartyUtil anomalies during Worker initialization; search application logs for concurrent cache access patterns.

What your security team should do

• Prioritize upgrade of all Firefox instances to 106+
• Apply tensorflow/tensorflow commit bce3717eaef4f769019fd18e990464ca4a2efeea across dependent packages
• Monitor EPSS trend for any increase beyond current 0.00402
• Audit Worker and CacheStorage usage patterns in web applications