CVE-2022-45419

What it actually does

The browser maintains an active TLS session established under a user-added certificate exception even after the exception is removed, allowing the connection to continue without re-validating the certificate.

Why it matters to the business

Organizations face continued exposure to untrusted remote servers through browser sessions, increasing risk of data integrity compromise on encrypted connections that should have been terminated.

How an attack unfolds

An attacker presents an invalid TLS certificate; the victim adds a security exception and establishes a long-lived connection; after the victim deletes the exception the browser keeps the session alive, treating the certificate as trusted for the duration of that connection.

How to fix it

Upgrade affected Firefox installations to version 107 or later; enforce automatic browser updates across the fleet and revoke any lingering manual certificate exceptions.

How to confirm the fix worked

Confirm Firefox version is 107 or newer on all endpoints; audit certificate exception lists and verify that connections to previously excepted hosts now enforce proper certificate validation.

Typical attack path

1. Attacker hosts a service using an invalid TLS certificate
2. Victim is tricked into adding a permanent security exception for that certificate
3. Victim opens a TLS connection that remains active
4. Victim removes the security exception
5. Browser silently keeps the original connection alive without re-checking the certificate

How to detect it

Search browser history and certificate exception logs for additions and subsequent removals of exceptions followed by continued network activity to the same host; examine TLS session durations in proxy or endpoint logs for connections that outlive exception removal events.

What your security team should do

• Prioritize deployment of Firefox 107+ across all managed systems
• Disable or restrict manual certificate exception workflows where possible
• Monitor browser update compliance metrics
• Review logs for any long-lived connections to hosts that previously required exceptions