{"id":"CVE-2022-1802","published":"2022-12-22T00:00:00Z","modified":"2025-04-16T15:17:14Z","title":"If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could…","vendor":"Mozilla","product":"Firefox ESR","tier":"core","eol":null,"affectedVersions":[{"vendor":"Mozilla","product":"Firefox ESR","versions":[">= unspecified, < 91.9.1"]},{"vendor":"Mozilla","product":"Firefox","versions":[">= unspecified, < 100.0.2"]},{"vendor":"Mozilla","product":"Firefox for Android","versions":[">= unspecified, < 100.3.0"]},{"vendor":"Mozilla","product":"Thunderbird","versions":[">= unspecified, < 91.9.1"]}],"description":{"text":"If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged context. This vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is an improperly controlled modification of object prototype attributes in Mozilla Firefox ESR, specifically in how JavaScript Array object methods can be corrupted through prototype pollution. An attacker who can exploit this, typically by getting a user to interact with attacker-supplied content over the network without needing credentials, could execute attacker-controlled JavaScript in a privileged browser context.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T05:10:32Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.28493,"percentile":0.98126,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2022-08-15","exploitedFirstSeen":"2022-08-15","ransomware":false,"evidence":[{"url":"https://securelist.com/it-threat-evolution-in-q2-2022-non-mobile-statistics/107133/","date":"2022-08-15"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":3,"pulses":[{"name":"Vulnerabilities in Mozilla Products","url":"https://otx.alienvault.com/pulse/629d9dafb28b4c6d47312074","created":"2022-06-06"},{"name":"Tails OS Users Warned Not to Use Bundled Tor Browser until Critical Bugs in Firefox Browser are Fixed","url":"https://otx.alienvault.com/pulse/629059c725096a77cc624646","created":"2022-05-27"},{"name":"Zero-day Bugs Fixed by Mozilla That Can Let Hackers Gain JavaScript Code Execution on Vulnerable Devices","url":"https://otx.alienvault.com/pulse/628f2795fd6f7de659125398","created":"2022-05-26"}],"provenance":"machine"},"cwes":[{"id":"CWE-1321","name":"Improperly Controlled Modification of Object Prototype Attributes"}],"references":[{"url":"https://www.mozilla.org/security/advisories/mfsa2022-19/","tags":[]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1770137","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-25081","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-25081","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2022-08-20","earliestUrl":"https://github.com/mistymntncop/CVE-2022-1802","repos":[{"name":"mistymntncop/CVE-2022-1802","url":"https://github.com/mistymntncop/CVE-2022-1802","stars":152,"created":"2022-08-20"}]},"first":{"date":"2022-08-20","source":"PoC-in-GitHub","url":"https://github.com/mistymntncop/CVE-2022-1802"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-08-15","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://securelist.com/it-threat-evolution-in-q2-2022-non-mobile-statistics/107133/","provenance":"source"},{"date":"2022-08-20","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/mistymntncop/CVE-2022-1802","provenance":"source"},{"date":"2022-12-22","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-1802","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":67.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1538 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.63,"detail":"percentile 0.9813"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":1.37,"detail":"3 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}