CVE-2022-26485
Mozilla Firefox Use-After-Free Vulnerability
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 21 March 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 14.26% probability · 97th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Listed 7 March 2022 · due 21 March 2022
- Weakness
- CWE-416
- Affected
- mozilla/firefox · mozilla/firefox focus · mozilla/firefox mobile · mozilla/thunderbird
- Source
- security@mozilla.org
EPSS 14.3% since 30 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
CISA notes
Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2022-26485
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1758062Exploit, Issue Tracking, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-09/Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1758062Exploit, Issue Tracking, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-09/Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26485US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.