CVE-2022-42927

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 106 Firefox ESR versions prior to 102.4 Thunderbird versions prior to 102.4

Description A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via performance.getEntries(). This issue is related to the inclusion of functions from an untrusted controlled area, which could allow a remote attacker to obtain URL entries from different sources by opening a specially crafted malicious site.

Recommendations For Firefox versions prior to 106, update to version 106 or later to resolve the issue. For Firefox ESR versions prior to 102.4, update to version 102.4 or later to resolve the issue. For Thunderbird versions prior to 102.4, update to version 102.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the performance.getEntries() function until a patch is available.