CVE-2022-38473: Mozilla Firefox

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or camera access). This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104.

Affected products

• Mozilla Firefox: before 104.0 (fixed in 104.0); from 102.0, before 102.2 (fixed in 102.2)
• Mozilla Firefox ESR: before 91.13 (fixed in 91.13)
• Mozilla Thunderbird: before 91.13 (fixed in 91.13); from 102.0, before 102.2 (fixed in 102.2)

Published 2022-12-22. Last modified 2026-06-17.