CVE-2022-29915 in Firefox
Summary
by MITRE • 12/22/2022
The Performance API did not properly hide the fact whether a request cross-origin resource has observed redirects. This vulnerability affects Firefox < 100.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 05/24/2026
The vulnerability described in CVE-2022-29915 represents a significant information disclosure issue within Firefox's Performance API implementation that could potentially expose sensitive cross-origin resource handling information. This flaw specifically impacts Firefox versions prior to 100, where the browser's performance monitoring capabilities inadvertently leaked details about redirect behavior across origin boundaries. The issue stems from the Performance API's inability to properly abstract or obscure the redirect observation mechanism when tracking cross-origin resource requests, creating a potential avenue for attackers to infer information about network traffic patterns and resource access behavior.
The technical flaw manifests in how Firefox's Performance API handles cross-origin resource timing data collection and reporting. When a browser makes a cross-origin request that undergoes redirects, the Performance API should ideally provide a consistent interface that does not reveal whether redirects occurred during the request lifecycle. However, this vulnerability allowed the API to leak information indicating redirect activity, essentially creating a side-channel attack vector. The implementation failed to properly sanitize or normalize the redirect information that should have been hidden from web applications accessing the Performance API. This misconfiguration aligns with CWE-200, which covers "Information Exposure" and specifically addresses situations where systems inadvertently reveal sensitive information through improper data handling or abstraction layers.
The operational impact of this vulnerability extends beyond simple information disclosure, as it could enable sophisticated attacks that map network topology and resource access patterns. Attackers could potentially use this information to infer the existence of certain resources, understand network infrastructure behavior, or even identify specific user activities by observing redirect patterns in performance data. This capability becomes particularly dangerous when combined with other fingerprinting techniques, as it contributes to building comprehensive user profiles that could be used for targeted attacks or tracking. The vulnerability affects web applications that rely on Performance API for monitoring and analytics, potentially exposing them to indirect information leakage that could compromise user privacy and security posture. According to ATT&CK framework, this vulnerability maps to T1566.002 which covers "Phishing via Social Media" and T1592.004 which addresses "Resource Development" as attackers could use this information to better target their campaigns or develop more sophisticated reconnaissance techniques.
Mitigation strategies for CVE-2022-29915 primarily involve updating Firefox installations to version 100 or later, where the vulnerability has been addressed through proper abstraction of redirect information in the Performance API. Organizations should also implement monitoring for any applications that rely heavily on Performance API data collection, ensuring that they are not inadvertently exposing redirect information through their own code implementations. Security teams should conduct thorough testing of performance monitoring systems to verify that no additional information leakage occurs through custom implementations or third-party libraries that might interact with the Performance API. Additionally, developers should be aware of this vulnerability when building applications that depend on cross-origin resource timing data, ensuring that their code does not create additional exposure points that could compound the issue. The fix implemented in Firefox 100 likely involved strengthening the abstraction layer between the underlying performance monitoring mechanisms and the public API surface, ensuring that redirect information is properly sanitized before being exposed to web applications.