CVE-2022-1196

What it actually does

Use-after-free vulnerability triggered when a VR Process is destroyed yet a stale reference remains and is subsequently dereferenced, resulting in memory corruption and a potentially exploitable crash.

Why it matters to the business

Attackers can cause browser or email client crashes that disrupt user workflows, and the flaw's public exploit availability increases risk of targeted attacks on outdated installations across many organizations.

How an attack unfolds

An attacker supplies specially crafted content that forces destruction of the VR Process while retaining a dangling reference; when the reference is later used, the use-after-free condition is triggered, enabling memory manipulation and potential code execution in affected Firefox ESR or Thunderbird instances.

How to fix it

Upgrade Mozilla Firefox ESR and Thunderbird to version 91.8 or later; enable automatic updates and verify installation of the corrected builds.

How to confirm the fix worked

Confirm client versions are at or above 91.8, review release notes for the fix, and test that VR-related content no longer triggers crashes in updated builds.

Typical attack path

1. Deliver malicious content via web page or email attachment to an unpatched client
2. Trigger VR Process creation and subsequent destruction while preserving a reference
3. Force reuse of the dangling pointer to induce use-after-free memory corruption
4. Leverage corruption to achieve crash or attempt further exploitation

How to detect it

Review browser crash logs and telemetry for VR Process related faults; correlate with access to potentially malicious web or email content around the time of the crash.

What your security team should do

• Prioritize immediate update of all Firefox ESR and Thunderbird deployments to 91.8 or newer
• Disable or restrict VR features where feasible until patches are applied
• Monitor exploit maturity feeds and threat intelligence for any increase in observed activity