Removing an XSLT parameter during processing could have lead to an exploitable use-after-free.
Affects Firefox before 97.0.2, Firefox ESR before 91.6.1, and Firefox for Android and Focus before 97.3.0; fixed in those releases.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 97.0.2, 91.6.1, 97.3.0, 91.6.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Mozilla Firefox (desktop, Android, and ESR editions), Thunderbird, and Focus are affected. A flaw in how the browser handles XSLT parameters during processing could let an attacker cause a use-after-free memory error, which could crash the software or potentially allow malicious code to run.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
Timeline
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- CVE published
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Mozilla Firefox
From unspecified · fixed in 97.0.2
- Mozilla Firefox ESR
From unspecified · fixed in 91.6.1
- Mozilla Firefox for Android
From unspecified · fixed in 97.3.0
- Mozilla Thunderbird
From unspecified · fixed in 91.6.2
- Mozilla Focus
From unspecified · fixed in 97.3.0
References 2
mozilla.org
bugzilla.mozilla.org
Questions about CVE-2022-26485
What does this mean?
Removing an XSLT parameter during processing can leave memory freed while the browser still refers to it, which is a use-after-free bug. Mozilla describes the flaw as exploitable.Source: mozilla.org
Am I affected, and how do I check?
The affected products are listed as Firefox, Firefox ESR, Firefox for Android, Focus, and Thunderbird, with the fixed versions 97.0.2, 91.6.1, 97.3.0, 97.3.0, and 91.6.2. The sources do not give an earliest affected version. Check your version in the browser's About page or Thunderbird's About dialog.Source: mozilla.org
What should I do about it?
Update Firefox to 97.0.2 or later, Firefox ESR to 91.6.1 or later, and Firefox for Android or Focus to 97.3.0 or later. Thunderbird's listed fixed version is 91.6.2.Source: mozilla.org
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-03-07, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data