CVE-2022-26387

What it actually does

Race condition in add-on installation where signature verification occurs before user prompt, allowing the underlying XPI file to be swapped without re-verification, resulting in execution of attacker-controlled code with full browser privileges.

Why it matters to the business

Attackers can silently install malicious extensions that steal credentials, exfiltrate data, or persist on user systems, increasing breach risk and potential regulatory exposure for organizations relying on older browser deployments.

How an attack unfolds

An attacker hosts or supplies a malicious add-on package. When the victim initiates installation, Firefox checks the signature of the original file. During the brief window while the user reviews the permission prompt, the attacker replaces the file on disk or via MITM. Firefox proceeds to install the now-modified add-on without re-checking the signature, granting the attacker arbitrary code execution inside the browser.

How to fix it

Upgrade Firefox to version 98 or later, Firefox ESR to 91.7 or later, and Thunderbird to 91.7 or later. Enforce automatic updates in managed environments and audit installed extensions for unexpected permissions.

How to confirm the fix worked

Verify installed browser versions meet or exceed the fixed releases listed above. Review extension management logs and about:addons for any add-ons installed around the time of the vulnerability window. Confirm automatic update policies are active.

Typical attack path

1. Attacker prepares malicious add-on and delivery mechanism (web page, update server compromise, or network position).
2. Victim is tricked into starting add-on installation, triggering signature verification.
3. During the user confirmation prompt, attacker modifies the on-disk add-on file.
4. Browser installs the altered add-on and grants requested permissions.
5. Malicious extension executes with browser privileges to perform data theft or further compromise.

How to detect it

Examine browser installation and extension logs for add-on load events immediately following signature verification calls. Look for unexpected XPI file modifications in the extensions directory or profile folders around install timestamps. Correlate with network activity to unknown update sources.

What your security team should do

• Immediately deploy browser updates to all endpoints.
• Disable add-on installation via policy where not required.
• Monitor for new extensions appearing without user initiation.
• Review EPSS and exploit availability trends for prioritization of remaining legacy instances.