CVE-2022-31746 Information disclosure in Firefox for iOS

Q: Is CVE-2022-31746 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-31746 exists.

Q: How do I fix CVE-2022-31746?

No fix has been published for CVE-2022-31746 yet. Limit exposure of the affected software until one is available.

Medium 6.5 Published 22 Dec 2022 Updated 15 Apr 2025

Attackers can leak internal secret UUID keys via the Referrer header, exposing protected internal URLs in Firefox for iOS.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2022-31746?

CVE-2022-31746 is a medium-severity vulnerability in Mozilla Firefox Mobile, published on 22 Dec 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header. This vulnerability affects Firefox for iOS < 102.

Weakness: CWE-200

Which versions are affected by CVE-2022-31746?

It affects 1 product.

Products include Mozilla Firefox Mobile.

How do I fix CVE-2022-31746?

No fix has been published for CVE-2022-31746 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-31746 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-31746 exists.

All Mozilla Firefox Mobile vulnerabilities

Sources

Also known as GHSA-5mgf-9mwf-m64w.