CVE-2022-26382

2022-12-2200:00:00

mozilla

www.cve.org

firefox

autofill

vulnerability

side-channel

font

inference

AI Score

5.9

Confidence

Low

EPSS

0.001

Percentile

37.2%

JSON

While the text displayed in Autofill tooltips cannot be directly read by JavaScript, the text was rendered using page fonts. Side-channel attacks on the text by using specially crafted fonts could have lead to this text being inferred by the webpage. This vulnerability affects Firefox < 98.

CNA Affected

[
  {
    "vendor": "Mozilla",
    "product": "Firefox",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "98",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]