CVE-2022-22751

What it actually does

Multiple memory safety bugs in the browser engine result in memory corruption that can be leveraged for arbitrary code execution.

Why it matters to the business

Compromised user systems can lead to theft of credentials, sensitive data, or installation of persistent malware across the organization's fleet of browsers and email clients.

How an attack unfolds

An attacker crafts malicious web content or email that triggers one of the memory corruption conditions during rendering or parsing, allowing control of the instruction pointer and execution of attacker-supplied code.

How to fix it

Upgrade Mozilla Firefox to version 96 or later, Firefox ESR to 91.5 or later, and Thunderbird to 91.5 or later. Apply updates through the product's built-in updater or enterprise deployment channels.

How to confirm the fix worked

Inspect installed product versions via about:support or equivalent dialogs and confirm they meet or exceed the fixed releases listed above.

Typical attack path

1. Deliver malicious HTML, JavaScript, or email attachment to the target
2. Trigger memory corruption during content processing
3. Achieve arbitrary code execution within the browser or Thunderbird process
4. Escalate privileges or establish persistence as needed

How to detect it

Search browser process crash logs and telemetry for unexpected memory faults around the time of suspicious web or email activity; correlate with network logs showing visits to untrusted domains.

What your security team should do

• Prioritize patching of all Firefox, Firefox ESR, and Thunderbird instances within the next maintenance window
• Enable automatic updates where policy permits
• Review browser and email client telemetry for any post-publication anomalies
• Block known malicious domains used in similar memory-corruption campaigns