CVE-2022-45413

What it actually does

The S.browser_fallback_url parameter allows an attacker-controlled redirect that forces SameSite=Strict cookies to be transmitted cross-site in Firefox for Android versions prior to 107.

Why it matters to the business

Attackers can bypass cookie isolation protections on Android browsers, potentially exposing session tokens or other sensitive data during redirects, increasing risk of account takeover in high-prevalence mobile environments.

How an attack unfolds

An attacker crafts a malicious link embedding the S.browser_fallback_url parameter pointing to an attacker site; when a victim on vulnerable Firefox Android clicks it, the browser follows the redirect while leaking SameSite=Strict cookies, allowing the attacker to capture and replay them.

How to fix it

Upgrade affected Firefox for Android installations to version 107 or later. For the listed tensorflow/tensorflow (GIT) packages, apply the fix in commit 1cf45b831eeb0cab8655c9c7c5d06ec6f45fc41b.

How to confirm the fix worked

Verify browser version is 107+ on Android devices; confirm no SameSite cookie leakage occurs on test redirects using the S.browser_fallback_url parameter; check tensorflow/tensorflow (GIT) repositories for the specified commit hash.

Typical attack path

1. Attacker identifies a target site using SameSite=Strict cookies and crafts a phishing or malicious link using the S.browser_fallback_url parameter.
2. Victim on Firefox for Android clicks the link, triggering the redirect.
3. Browser sends the cookies despite SameSite=Strict policy due to the fallback handling.
4. Attacker receives the leaked cookies on their controlled domain and uses them to impersonate the victim.

How to detect it

Review web server access logs for unexpected redirects involving browser_fallback_url parameters; inspect browser history or proxy logs for SameSite cookie transmissions to external domains; search application logs for anomalous session activity following Android Firefox user agents.

What your security team should do

• Prioritize patching all Firefox for Android instances to 107+ immediately given the 1395 days since publication.
• Monitor EPSS trend and re-evaluate if exploit maturity increases.
• Update tensorflow/tensorflow (GIT) to commit 1cf45b831eeb0cab8655c9c7c5d06ec6f45fc41b across all dependents.
• Implement additional cookie protections such as __Host- prefix where feasible.