CVE-2022-34469

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 102

Description The issue is related to the handling of TLS Certificate errors on domains protected by the HSTS header. When such an error occurs, the browser should prevent the user from bypassing the certificate error. However, on Firefox for Android, users were given the option to bypass the error, which could only be done explicitly by the user. This could potentially allow a remote attacker to execute arbitrary code by exploiting the vulnerability in the TLS certificate authentication procedure.

Recommendations For Firefox for Android versions prior to 102, update to version 102 or later to resolve the issue. As a temporary workaround, consider avoiding domains with TLS certificate errors to minimize the risk of exploitation. Restrict access to sensitive information when using Firefox for Android until the update is applied.