CVE-2022-45418

What it actually does

The flaw permits a CSS-specified custom mouse cursor to render over browser chrome UI elements under certain conditions, enabling visual overlay that can obscure or impersonate interface components.

Why it matters to the business

Users may be deceived into unintended interactions, increasing phishing or spoofing success rates, eroding trust in the browser, and potentially exposing credentials or sensitive actions across the large installed base of affected Mozilla products.

How an attack unfolds

An attacker hosts a webpage containing crafted CSS cursor rules that position a custom cursor to overlap browser UI; the victim is lured to the page and interacts with the spoofed elements under the false assumption they are legitimate browser controls.

How to fix it

Upgrade Mozilla Firefox to version 107 or later, Firefox ESR to 102.5 or later, and Thunderbird to 102.5 or later; enforce automatic updates where possible and verify installed versions centrally.

How to confirm the fix worked

Confirm browser versions meet or exceed the fixed releases listed in the advisory; test affected cursor CSS on a sample page to ensure the cursor no longer draws over UI elements after the update.

Typical attack path

1. Create a malicious webpage embedding specific CSS cursor definitions positioned over chrome
2. Host the page on an attacker-controlled domain or compromised site
3. Deliver the URL to targets via phishing email, social engineering, or malvertising
4. Victim loads the page and performs clicks or interactions based on the overlaid cursor

How to detect it

Examine browser history and proxy logs for visits to suspicious or newly registered domains around the time of reported incidents; no persistent artifacts are left on disk, so focus on user reports of unexpected cursor behavior or anomalous clicks.

What your security team should do

• Prioritize deployment of the fixed browser versions across all endpoints given the public disclosure and broad user base
• Configure enterprise update policies to enforce timely Mozilla product patching
• Conduct user awareness training on recognizing potential UI spoofing attempts
• Review web proxy or browser telemetry logs for access to domains known for cursor-related abuse if available