CVE-2022-1529

What it actually does

Improper input validation allows a crafted message sent to the parent process to double-index a JavaScript object, causing prototype pollution that results in attacker-controlled JavaScript executing with parent-process privileges.

Why it matters to the business

Successful exploitation can let attackers run arbitrary code with elevated browser privileges, leading to data theft, malware installation, or full account compromise on affected user systems.

How an attack unfolds

An attacker crafts a malicious message that targets the parent process, leverages double-indexing to pollute JavaScript prototypes, and achieves execution of attacker-supplied code in the privileged parent context.

How to fix it

Upgrade Firefox to 100.0.2 or later, Firefox ESR to 91.9.1 or later, Firefox for Android to 100.3.0 or later, and Thunderbird to 91.9.1 or later. Apply vendor updates as soon as they become available and verify installed versions match the patched releases.

How to confirm the fix worked

Confirm browser and Thunderbird versions meet or exceed the minimum patched releases listed by the vendor; re-test affected messaging paths after upgrade to ensure the double-indexing behavior is no longer possible.

Typical attack path

1. Deliver malicious content or message via web page or email to a vulnerable browser or Thunderbird instance
2. Trigger the message handler in the parent process with specially constructed input
3. Exploit double-indexing to pollute object prototypes
4. Execute arbitrary JavaScript with parent-process privileges

How to detect it

Review browser and Thunderbird process logs, crash reports, and parent-child process communication artifacts for unexpected JavaScript execution or anomalous message handling; correlate with user reports of unexpected behavior after visiting untrusted sites or opening email.

What your security team should do

• Prioritize immediate updates to all affected Mozilla products across the environment
• Monitor vendor advisories for any additional fixed versions or backports
• Review browser extension and email handling policies to reduce exposure surface until patches are deployed