CVE-2022-45410

What it actually does

ServiceWorker interception of FetchEvent requests drops the request origin, allowing SameSite cookies to be sent cross-site in violation of their intended protections.

Why it matters to the business

Attackers may perform unauthorized actions or access protected user data in web applications that rely on SameSite cookie attributes for security, increasing risk of session hijacking or data exposure across many browser users.

How an attack unfolds

An attacker hosts a malicious page that registers a ServiceWorker; when the victim visits and the worker intercepts a cross-site request, the lost origin causes the browser to attach SameSite cookies that should have been blocked, enabling the attacker to abuse the victim's authenticated session.

How to fix it

Upgrade affected browsers to Firefox ESR 102.5 or later, Thunderbird 102.5 or later, or Firefox 107 or later. For the listed tensorflow/tensorflow GIT repository, apply the fix present in commit 27a65a43cf763897fecfa5cdb5cc653fc5dd0346.

How to confirm the fix worked

Confirm browser versions meet or exceed the fixed releases; test that SameSite cookie attributes are respected on cross-site requests intercepted by ServiceWorkers; verify the tensorflow/tensorflow repository is at commit 27a65a43cf763897fecfa5cdb5cc653fc5dd0346 or newer.

Typical attack path

1. Attacker registers a ServiceWorker on a controlled origin
2. Victim is lured to a page that triggers a cross-site request to the target application
3. ServiceWorker intercepts the request via FetchEvent and takes ownership
4. Origin information is stripped, bypassing SameSite restrictions
5. Cookies are attached and the request proceeds with unintended authentication context
6. Attacker abuses the resulting session or performs actions on the victim's behalf

How to detect it

Review browser process logs and ServiceWorker registration events for unexpected interceptors; inspect network traffic for cross-site requests carrying cookies that should have been restricted by SameSite attributes; correlate with known malicious page visits in proxy or endpoint logs.

What your security team should do

• Prioritize browser updates for all endpoints given the 1395-day window since disclosure and slight EPSS increase
• Audit web applications that set SameSite cookies and rely on them for authorization boundaries
• Deploy endpoint management to enforce minimum browser versions organization-wide
• Monitor for any new exploit maturity signals despite current None status