Skip to content
OpenAdvisories
Medium · 6.1 CVE-2022-45413 EUVD-2022-48285GHSA-h295-679q-mhm8

Using the <code>S.browser_fallback_url parameter</code> parameter, an attacker could redirect a user to a URL and cause SameSite=Strict coo…

Published Dec 22, 2022 · Updated Apr 15, 2025 · Assigned by mozilla

Vendor: Mozilla Product: Firefox Package: firefox Package: mozjs38 Package: mozjs52 Package: mozjs68 Package: mozjs78 Package: mozjs91 Category: Browsers Ecosystem: Ubuntu

Description

Using the <code>S.browser_fallback_url parameter</code> parameter, an attacker could redirect a user to a URL and cause SameSite=Strict cookies to be sent.<br>*This issue only affects Firefox for Android. Other operating systems are not affected.*. This vulnerability affects Firefox < 107.

Affected products

VendorProductAffectedFixed
Mozilla Firefox unspecified – < 107 107

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS mozjs78 +1 No fix yet —
Ubuntu 20.04 LTS firefox 107.0+build2-0ubuntu0.20.04.1 USN-5726-1
Ubuntu 20.04 LTS mozjs52 +1 No fix yet —
Ubuntu 18.04 LTS firefox 107.0+build2-0ubuntu0.18.04.1 USN-5726-1
Ubuntu 18.04 LTS mozjs38 +1 No fix yet —

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed MozillaFirefox 107.0-1.1 openSUSE-SU-2024:12518-1
openSUSE Tumbleweed firefox-esr 128.5.1-1.1 openSUSE-SU-2024:14572-1

Advisories 5

References