CVE-2022-22755

What it actually does

Use-after-free in XSL transform handling allows JavaScript execution to persist within the same-origin policy after tab closure.

Why it matters to the business

Users visiting malicious sites could have sensitive data exposed or sessions hijacked with low attacker effort; widespread browser deployment means broad exposure until patched.

How an attack unfolds

An attacker hosts a malicious XSL document on a web server; when a Firefox user loads the page, the XSLT processing triggers the use-after-free, permitting continued JavaScript execution even after the tab closes.

How to fix it

Upgrade all instances of Firefox to version 97 or later.

How to confirm the fix worked

Verify installed Firefox version is 97 or newer; confirm absence of the described XSL transform behavior via regression testing or update logs.

Typical attack path

1. Host malicious XSL document on attacker-controlled web server
2. Lure victim to load the page in vulnerable Firefox
3. Trigger XSL transform to activate use-after-free condition
4. Execute arbitrary JavaScript within same-origin bounds after tab closure

How to detect it

Review browser process logs and crash reports for unexpected JavaScript activity after tab termination; correlate with network requests to suspicious XSL-serving domains.

What your security team should do

• Prioritize immediate update of all Firefox deployments to version 97 or newer
• Block known malicious domains serving XSL content at network perimeter
• Enable automatic browser updates organization-wide