Mozilla · Firefox
CVE-2022-26485
Mozilla Firefox Use-After-Free Vulnerability
What it is
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
CISA: Mozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: March 21, 2022
More exploited flaws from Mozilla
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 15, 2024 | Use-After-Free | Firefox | Critical 9.8 | 23% |
| May 25, 2022 | Security Feature Bypass | Firefox | High 8.8 | 69% |
| Mar 7, 2022 | Use-After-Free | Firefox | Critical 9.6 | 2.4% |
| Mar 3, 2022 | Information Disclosure | Firefox | Medium 6.5 | 6.7% |
| Oct 6, 2025 | Remote Code Execution | Multiple Products | Critical 9.8 | 83% |
| Jun 22, 2023 | Use-After-Free | Firefox, Firefox ESR, and Thunderbird | High 7.5 | 87% |
| May 23, 2022 | Type Confusion | Firefox and Thunderbird | High 8.8 | 38% |
| May 23, 2022 | Sandbox Escape | Firefox and Thunderbird | Critical 10.0 | 56% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.