CVE-2022-45403
Mozilla: Service Workers might have learned size of cross-origin media files
Severity
ImportantRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · November 15, 2022
Updated · November 21, 2025
Description
The Mozilla Foundation Security Advisory describes this flaw as: Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for cross-origin media combined with Range requests might have allowed them to determine the presence or length of a media file.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 7.5CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-829 · Inclusion of Functionality from Untrusted Control Sphere