Mozilla · Firefox
CVE-2022-26485
Mozilla Firefox Use-After-Free Vulnerability
Qué es
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
CISA: Mozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution.
Qué hacer
Apply updates per vendor instructions.
Plazo para las agencias federales de EE. UU.: 21 de marzo de 2022
Más fallos explotados de Mozilla
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 15 oct 2024 | Use-After-Free | Firefox | Crítica 9,8 | 23% |
| 25 may 2022 | Security Feature Bypass | Firefox | Alto 8,8 | 69% |
| 7 mar 2022 | Use-After-Free | Firefox | Crítica 9,6 | 2,4% |
| 3 mar 2022 | Information Disclosure | Firefox | Media 6,5 | 6,7% |
| 6 oct 2025 | Remote Code Execution | Multiple Products | Crítica 9,8 | 83% |
| 22 jun 2023 | Use-After-Free | Firefox, Firefox ESR, and Thunderbird | Alto 7,5 | 87% |
| 23 may 2022 | Type Confusion | Firefox and Thunderbird | Alto 8,8 | 38% |
| 23 may 2022 | Sandbox Escape | Firefox and Thunderbird | Crítica 10,0 | 56% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.