CVE-2022-22737

What it actually does

Race condition during audio sink construction allows use-after-free when audio playback overlaps with window closure, resulting in a potentially exploitable crash.

Why it matters to the business

Attackers can crash browsers or execute arbitrary code on affected systems, risking data theft, ransomware deployment, or loss of user productivity across browser-dependent operations.

How an attack unfolds

An attacker serves a malicious page that initiates audio playback and simultaneously triggers window closure in a timed sequence to win the race condition, freeing memory that is later reused for code execution.

How to fix it

Upgrade Mozilla Firefox to version 96 or later, Firefox ESR to 91.5 or later, and Thunderbird to 91.5 or later. Apply updates immediately given available exploit code.

How to confirm the fix worked

Verify installed browser and email client versions against the fixed releases; re-test audio playback and rapid window close scenarios in a controlled environment after patching.

Typical attack path

1. Deliver malicious HTML/JS via web page or email attachment
2. Trigger audio file playback to initialize audio sink
3. Force window or tab closure while audio sink is active
4. Exploit resulting use-after-free for arbitrary code execution
5. Establish persistence or exfiltrate data

How to detect it

Review browser crash reports and process termination logs for use-after-free signatures during audio playback; correlate with web request logs showing media file loads immediately before abrupt closures.

What your security team should do

• Prioritize patching all Firefox, ESR, and Thunderbird instances within 48 hours due to public exploit availability
• Enable automatic updates for Mozilla products across the fleet
• Block untrusted web content and email attachments that could trigger media playback
• Monitor for browser crashes correlated with audio or media activity in endpoint logs