CVE-2022-46873

What it actually does

Missing implementation of the unsafe-hashes CSP directive allows an attacker who can inject markup into an otherwise CSP-protected page to execute injected scripts, subject to the remaining policy constraints.

Why it matters to the business

Attackers could run unauthorized code inside users' browsers on protected pages, potentially leading to session hijacking, data theft, or further compromise of user accounts on affected sites.

How an attack unfolds

An attacker first identifies a page that accepts user-controlled markup but is protected by a Content Security Policy. Because the browser lacks unsafe-hashes support, the attacker crafts markup that injects executable script while still satisfying the policy's hash or nonce rules, resulting in code execution within the page's origin.

How to fix it

Upgrade all Firefox installations to version 108 or later, which implements the unsafe-hashes CSP directive. Review and tighten existing Content Security Policies to reduce reliance on inline scripts where possible.

How to confirm the fix worked

Confirm Firefox version is 108 or higher. Test pages with CSP headers that include unsafe-hashes directives and verify that injected scripts are blocked as expected.

Typical attack path

1. Locate a page that reflects attacker-controlled markup while enforcing a Content Security Policy
2. Craft markup containing a script whose hash matches an allowed source under unsafe-hashes semantics
3. Deliver the payload to a victim browser running an unpatched Firefox version
4. Bypass CSP restrictions and execute arbitrary JavaScript in the victim's session context

How to detect it

Review web server or browser CSP violation reports for unexpected inline script executions on pages protected by Content Security Policy. Correlate with Firefox version telemetry or user-agent strings indicating versions below 108.

What your security team should do

• Prioritize updating all Firefox deployments to 108 or newer
• Audit web applications for CSP policies that could be weakened by this browser limitation
• Enable CSP reporting to monitor for unexpected script execution attempts
• Educate developers on safe use of unsafe-hashes once browser support is confirmed