CVE-2022-29916

6.5 mediumEPSS 0.8%

Medium (6.5) in mozilla. EPSS 0.8% chance of exploitation in the next 30 days.

Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables. This could have been used to probe the browser history. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2022-12-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mozilla:firefox
mozilla:firefox_esr
mozilla:thunderbird

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1760674
https://www.mozilla.org/security/advisories/mfsa2022-16/
https://www.mozilla.org/security/advisories/mfsa2022-17/
https://www.mozilla.org/security/advisories/mfsa2022-18/
https://bugzilla.mozilla.org/show_bug.cgi?id=1760674

Check your stack JSON