CVE-2022-31746: 
NixOS vulnerability analysis and mitigation

CVE-2022-31746 is a security vulnerability discovered in Firefox for iOS versions prior to 102. The vulnerability involves internal URLs that are protected by a secret UUID key, which could be leaked to web pages through the Referrer header (Mozilla Advisory, NVD).

The vulnerability is classified with a CVSS v3.1 Base Score of 6.5 (MEDIUM) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. The issue stems from insufficient protection of privileged internal URLs, where the secret UUID key used for protection could be exposed through the Referrer header. This vulnerability is categorized as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (NVD).

The vulnerability could allow untrusted web content to bypass security protections and potentially abuse existing XSS vulnerabilities in the browser. This could lead to unauthorized access to internal browser pages and potential exposure of sensitive information (Mozilla Advisory, Bugzilla).

The vulnerability was fixed in Firefox for iOS version 102. Users should update to this version or later to protect against this security issue. The fix involves implementing proper referrer policy settings in the ReaderViewLoading.html template (Mozilla Advisory).