CVE-2022-45420

What it actually does

Rendering engine flaw allows table elements placed inside an iframe to escape the iframe's clipping boundaries, enabling content to be drawn in the parent document's visual space.

Why it matters to the business

Attackers can present deceptive content that appears to originate from trusted sites, increasing risk of phishing success and user-driven credential or data compromise across browser-dependent operations.

How an attack unfolds

An attacker hosts a malicious page embedding an iframe that loads attacker-controlled content containing tables; when the victim visits the page, the table renders outside the iframe, visually spoofing UI elements or trusted site content to confuse the user into performing actions such as entering credentials.

How to fix it

Upgrade Mozilla Firefox to version 107 or later, Firefox ESR to 102.5 or later, and Thunderbird to 102.5 or later. Apply updates through the product's built-in updater or package manager and verify the new version string after restart.

How to confirm the fix worked

Confirm the installed browser or mail client reports a version at or above the fixed releases (Firefox 107+, ESR 102.5+, Thunderbird 102.5+); re-test rendering of known iframe-plus-table test cases in a lab environment to verify boundary clipping behavior.

Typical attack path

1. Attacker crafts a page containing a malicious iframe with table markup designed to overflow boundaries
2. Victim is lured to the attacker's page via phishing or compromised site
3. Browser renders the iframe content outside its visual container
4. User is presented with spoofed interface elements and interacts with them

How to detect it

Review browser process execution logs and crash reports for unexpected rendering anomalies; correlate web proxy or DNS logs for visits to domains hosting iframe-based content shortly before reported user confusion incidents.

What your security team should do

• Prioritize deployment of the listed fixed versions across all managed endpoints within the next patching cycle
• Enable automatic updates where policy permits and monitor for update failures
• Add browser version checks to endpoint compliance scanning