CVE-2022-26386

What it actually does

Temporary download files are placed in the shared /tmp directory instead of a user-specific subdirectory, allowing other local users on macOS and Linux systems to read or modify the files and potentially disclose sensitive content from network-initiated downloads.

Why it matters to the business

On shared Mac or Linux systems, downloaded files containing sensitive information could be accessed by other users on the same machine, increasing risk of data exposure in multi-user environments; the issue has been public for years with publicly available exploit details but no widespread ransomware use.

How an attack unfolds

An attacker convinces a victim to visit a malicious site or open attacker-controlled content that triggers a file download in Firefox or Thunderbird; the downloaded temporary file lands in the shared /tmp directory where a local attacker on the same system can read or tamper with it, leading to disclosure of the file contents.

How to fix it

Upgrade Mozilla Firefox ESR to version 91.7 or later and Mozilla Thunderbird to version 91.7 or later on all macOS and Linux systems; verify that temporary download handling reverts to per-user directories after the update.

How to confirm the fix worked

Confirm installed versions are at or above ESR 91.7 and Thunderbird 91.7; inspect temporary file creation behavior during downloads to ensure files are written under user-specific paths rather than the top-level /tmp directory.

Typical attack path

1. Attacker hosts malicious content that triggers a file download when visited
2. Victim user on macOS or Linux opens the content in vulnerable Firefox ESR or Thunderbird
3. Browser writes temporary file to /tmp instead of user-specific path
4. Local attacker on the same system reads or modifies the file in /tmp

How to detect it

Search application and system logs for file creation events under /tmp by Firefox or Thunderbird processes; look for unexpected access or modification of temporary files by non-owner users on multi-user macOS and Linux hosts.

What your security team should do

• Prioritize patching all macOS and Linux instances of Firefox ESR and Thunderbird to 91.7 or newer within standard patch windows
• Review multi-user system policies to ensure downloads are not stored in shared directories
• Monitor for any remaining systems running versions prior to 91.7 given the public exploit availability