CVE-2022-22740

What it actually does

Use-after-free condition triggered when network request objects are released prematurely during handle cleanup, enabling memory corruption that can lead to arbitrary code execution or denial of service.

Why it matters to the business

Attackers could gain control of affected browsers or email clients on user systems, leading to theft of credentials, session hijacking, or deployment of malware with minimal user interaction required beyond visiting a malicious page.

How an attack unfolds

An attacker hosts a webpage containing specially crafted network request patterns that force early object release; when the victim browser processes the page the dangling references are accessed, corrupting memory and allowing shellcode execution within the browser process.

How to fix it

Upgrade Mozilla Firefox to version 96 or later, Firefox ESR to 91.5 or later, and Thunderbird to 91.5 or later. Where immediate patching is not possible, enforce application allow-listing and restrict JavaScript execution from untrusted origins.

How to confirm the fix worked

Verify installed product versions against the fixed releases listed above; re-test affected network request code paths in a controlled environment after upgrade to confirm absence of the early-release condition.

Typical attack path

1. Attacker prepares malicious webpage exploiting the network request lifecycle
2. Victim is lured to the page via phishing or compromised site
3. Browser initiates network requests that trigger premature object freeing
4. Use-after-free corrupts memory and redirects control flow
5. Attacker payload executes within the browser sandbox or escapes it

How to detect it

Review browser crash logs and telemetry for sudden terminations during network activity; correlate with web request logs showing unusual timing or malformed responses that coincide with process instability.

What your security team should do

• Apply the listed version upgrades to all instances within 48 hours given public exploit availability
• Monitor browser crash reports for patterns involving network request handles
• Block known malicious domains used in similar browser exploitation campaigns
• Review and tighten content security policies to reduce attack surface for memory-safety flaws