CVE-2022-46872

What it actually does

Partial sandbox escape from a compromised content process allowing arbitrary file reads on Linux via crafted clipboard-related IPC messages.

Why it matters to the business

On older Linux deployments of Thunderbird this could lead to unauthorized access to sensitive local files after an initial content-process compromise; Firefox and ESR are listed as affected in the advisory but the root cause is Linux-Thunderbird-specific. The issue is nearly four years old with low exploit probability and no known active campaigns.

How an attack unfolds

An attacker first obtains code execution inside a content process (renderer), then sends specially crafted IPC messages related to clipboard handling to escape the sandbox boundary and read arbitrary files from the host filesystem.

How to fix it

Upgrade Mozilla Firefox to version 108 or later, Firefox ESR to 102.6 or later, and Thunderbird to 102.6 or later. On Linux systems running Thunderbird, ensure the update is applied promptly; no other operating systems are affected by this specific flaw.

How to confirm the fix worked

Verify installed product versions meet or exceed the fixed releases (Firefox 108+, ESR 102.6+, Thunderbird 102.6+). Re-test any custom IPC or clipboard handling code paths if local patches were applied.

Typical attack path

1. Gain initial code execution inside a browser content process via a separate renderer exploit or malicious page
2. Craft and send clipboard-related IPC messages that bypass sandbox restrictions
3. Read arbitrary files from the Linux host filesystem outside the sandbox

How to detect it

Examine browser process logs and IPC audit trails for anomalous clipboard-related messages originating from content processes; correlate with file-access events outside expected sandbox directories on Linux hosts.

What your security team should do

• Prioritize updating all Linux Thunderbird installations to 102.6 or newer
• Update Firefox and Firefox ESR instances to the fixed versions as part of routine patching
• Review sandbox and IPC logging configurations to increase visibility into content-process behavior
• Monitor EPSS and KEV status for any future changes given the four-year publication age