CVE-2022-46873

2022-12-2200:00:00

mozilla

www.cve.org

firefox

vulnerability

unsafe-hashes

csp

executable script

8.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.2%

JSON

Because Firefox did not implement the <code>unsafe-hashes</code> CSP directive, an attacker who was able to inject markup into a page otherwise protected by a Content Security Policy may have been able to inject executable script. This would be severely constrained by the specified Content Security Policy of the document. This vulnerability affects Firefox < 108.

CNA Affected

[
  {
    "vendor": "Mozilla",
    "product": "Firefox",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "108",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]