CVE-2022-26382

While the text displayed in Autofill tooltips cannot be directly read by JavaScript, the text was rendered using page fonts. Side-channel attacks on the text by using specially crafted fonts could have lead to this text being inferred by the webpage. This vulnerability affects Firefox < 98.

• CWE-203
• CWE-203

• https://bugzilla.mozilla.org/show_bug.cgi?id=1741888Exploit, Issue Tracking, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-10/Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1741888Exploit, Issue Tracking, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-10/Vendor Advisory

Published

Dec 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-26375Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8
• CVE-2022-26376A memory corruption vulnerability exists in the httpd unesca…9.8
• CVE-2022-26377Inconsistent Interpretation of HTTP Requests ('HTTP Request …7.5
• CVE-2022-2638The Export All URLs WordPress plugin before 4.4 does not val…6.5
• CVE-2022-26380A vulnerability has been identified in SCALANCE X302-7 EEC (…7.5
• CVE-2022-26381An attacker could have caused a use-after-free by forcing a …8.8
• CVE-2022-26383When resizing a popup after requesting fullscreen access, th…4.3
• CVE-2022-26384If an attacker could control the contents of an iframe sandb…9.6
• CVE-2022-26385In unusual circumstances, an individual thread may outlive t…6.5
• CVE-2022-26386Previously Firefox for macOS and Linux would download tempor…6.5
• CVE-2022-26387When installing an add-on, Firefox verified the signature be…7.5
• CVE-2022-26388A use of hard-coded password vulnerability may allow authent…6.4