Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables. This could have been used to probe the browser history. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100.
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
| Link | Tags |
|---|---|
| https://www.mozilla.org/security/advisories/mfsa2022-16/ | vendor advisory exploit |
| https://www.mozilla.org/security/advisories/mfsa2022-18/ | vendor advisory exploit |
| https://www.mozilla.org/security/advisories/mfsa2022-17/ | vendor advisory exploit |
| https://bugzilla.mozilla.org/show_bug.cgi?id=1760674 | vendor advisory issue tracking exploit |