CVE-2022-42931

What it actually does

The Form Manager component saves usernames to an unencrypted on-disk file instead of routing them through the encrypted Password Manager storage.

Why it matters to the business

Local users or processes can read stored login usernames without needing credentials, exposing account identifiers on shared or compromised systems and increasing risk of targeted follow-on attacks.

How an attack unfolds

An attacker with local filesystem access locates the unencrypted Form Manager file, reads the stored usernames, and uses that information to craft phishing or credential-stuffing campaigns against the affected accounts.

How to fix it

Upgrade Firefox to version 106 or later so that usernames are handled exclusively by the Password Manager. If immediate upgrade is not possible, disable Form Manager autocomplete for login fields via about:config.

How to confirm the fix worked

Confirm Firefox version is 106 or newer; inspect the profile directory to verify no new unencrypted username files are created after login events.

Typical attack path

1. Obtain local access or malware foothold on the target workstation
2. Locate the unencrypted Form Manager data file
3. Read plaintext usernames
4. Correlate usernames with other reconnaissance to launch account-targeted attacks

How to detect it

Review local browser profile directories for unexpected plaintext files containing login-related strings; correlate with file creation timestamps around login events.

What your security team should do

• Prioritize deployment of Firefox 106+ across all managed endpoints within 30 days
• Audit browser configuration baselines to enforce Password Manager usage
• Add browser version checks to endpoint compliance scans