CVE-2022-45403

What it actually does

Service Workers can leverage timing side-channels on Range requests for cross-origin media responses to infer the presence or length of otherwise opaque resources, bypassing intended cross-origin isolation protections.

Why it matters to the business

Attackers may obtain limited privacy-sensitive details about media content a user can access across origins; with low EPSS and no known exploitation campaigns after more than three years, operational risk remains modest for most organizations.

How an attack unfolds

An attacker hosts a malicious page that registers a controlled Service Worker, issues Range requests against a cross-origin media target, and measures response timing to determine file existence or size without triggering CORS or opaque-response safeguards.

How to fix it

Upgrade Firefox to version 107 or later, Firefox ESR to 102.5 or later, and Thunderbird to 102.5 or later; ensure automatic updates are enabled across the fleet.

How to confirm the fix worked

Confirm installed browser versions meet or exceed the fixed releases listed above and verify that Service Worker timing behavior for cross-origin Range requests no longer leaks length or presence information.

Typical attack path

1. Register a malicious Service Worker from attacker-controlled origin
2. Trigger Range requests against target cross-origin media resource
3. Measure timing deltas to infer presence or length of the media file
4. Exfiltrate inferred metadata to attacker server

How to detect it

Review browser process logs and Service Worker registration events for unexpected registrations from untrusted origins; correlate with network timing anomalies on media requests.

What your security team should do

• Prioritize browser updates via enterprise management tools given the three-year publication window and slight EPSS uptick
• Audit Service Worker usage policies and restrict registration where possible
• Monitor vendor security advisories for related browser engine fixes