{"id":"CVE-2022-26485","published":"2022-12-22T20:15:22Z","modified":"2026-08-19T15:29:21Z","title":"Mozilla Firefox Use-After-Free Vulnerability","vendor":"Mozilla","product":"Firefox","tier":"core","eol":null,"description":{"text":"Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a use-after-free in Mozilla Firefox's XSLT processing, where removing an XSLT parameter during processing can leave memory referenced after it has been freed. An attacker can exploit it remotely without authentication by getting a user to interact with crafted content, such as visiting a malicious page, which can lead to full compromise of confidentiality, integrity, and availability.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:10:42Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.14261,"percentile":0.96586,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2022-03-07","dueDate":"2022-03-21","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-26485","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-03-05","exploitedFirstSeen":"2022-03-05","ransomware":false,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2022-03-05"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-07"},{"url":"https://blog.google/threat-analysis-group/new-details-on-commercial-spyware-vendor-variston/","date":"2022-11-30"},{"url":"https://raw.githubusercontent.com/blackorbird/APT_REPORT/master/summary/2023/360_APT_Annual_Research_Report_2022.pdf","date":"2023-01-17"},{"url":"https://www.mandiant.com/resources/blog/zero-days-exploited-2022","date":"2023-03-20"},{"url":"https://storage.googleapis.com/gweb-uniblog-publish-prod/documents/Buying_Spying_-_Insights_into_Commercial_Surveillance_Vendors.pdf","date":"2024-02-06"}],"evidenceTotal":6,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-416","name":"Use After Free"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1758062","tags":["Exploit","Issue Tracking","Vendor Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2022-09/","tags":["Vendor Advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1758062","tags":["Exploit","Issue Tracking","Vendor Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2022-09/","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26485","tags":["US Government Resource"]}],"techniques":[{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Malicious web content triggers browser memory corruption","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Removing an XSLT parameter during processing could have lead to an exploitable use-after-free","start":0,"end":93}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Exploit runs via client application processing","mappingType":"primary_impact","evidence":[{"from":"description","quote":"We have had reports of attacks in the wild abusing this flaw","start":95,"end":155}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-31043","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-31043","exploited":true,"exploitedSince":"2022-03-07","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2023-01-31","earliestUrl":"https://github.com/mistymntncop/CVE-2022-26485","repos":[{"name":"mistymntncop/CVE-2022-26485","url":"https://github.com/mistymntncop/CVE-2022-26485","stars":17,"created":"2023-01-31"}]},"first":{"date":"2023-01-31","source":"PoC-in-GitHub","url":"https://github.com/mistymntncop/CVE-2022-26485"},"provenance":"source"},"exploitRefs":["https://bugzilla.mozilla.org/show_bug.cgi?id=1758062"],"flow":[{"stage":"exploitation","techniques":["T1189"],"provenance":"ai"},{"stage":"primary","techniques":["T1203"],"provenance":"ai"}],"timeline":[{"date":"2022-03-05","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2022-03-07","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-07","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-31043","provenance":"source"},{"date":"2022-12-22","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26485","provenance":"source"},{"date":"2023-01-31","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/mistymntncop/CVE-2022-26485","provenance":"source"}],"speed":{"daysToPublicExploit":40,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":68.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1699 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.32,"detail":"percentile 0.9659"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-mozilla-firefox-cwe-416"}}