CVE-2022-45415

What it actually does

The browser fails to validate or sanitize the HTML page title when constructing the filename for a downloaded file, permitting a malicious extension to be appended instead of forcing a safe .html suffix.

Why it matters to the business

Organizations face elevated risk of malware execution on endpoints because users may inadvertently run files that appear legitimate but contain harmful payloads, increasing incident response and remediation costs.

How an attack unfolds

An attacker crafts a web page whose title contains a filename with a dangerous extension, hosts the page, and tricks a victim into downloading the HTML file; when the victim later opens the saved file the operating system executes it with the attacker-chosen extension.

How to fix it

Upgrade to Firefox 107 or later. For tensorflow/tensorflow (GIT) apply commit 3a754740d5414e362512ee981eefba41561a63a6.

How to confirm the fix worked

Confirm the browser version is 107 or newer; verify that downloaded HTML files always receive a .html or .htm extension regardless of page title content.

Typical attack path

1. attacker hosts malicious HTML page with crafted title
2. victim is lured to the page and initiates download
3. browser saves file using the malicious extension from the title
4. victim or automated process executes the downloaded file
5. malicious code runs with user privileges

How to detect it

Review download logs and file-system audit trails for HTML files saved with non-.html extensions originating from web browsers; correlate with subsequent process execution of those files.

What your security team should do

• Immediately update all Firefox installations to version 107 or newer
• Block execution of unexpected file types from the Downloads folder via application allow-listing
• Educate users to inspect file extensions before opening downloads
• Monitor EPSS trend and re-evaluate if exploitation maturity increases