CVE-2022-26485

What it actually does

CVE-2022-26485 is a use-after-free vulnerability in Mozilla’s XSLT parameter handling. During XSLT processing, removal of a parameter could leave stale memory references that an attacker-controlled web page or document can manipulate. Successful exploitation can cause memory corruption and potentially execute attacker-supplied code in the context of the affected application, such as Firefox, Firefox ESR, Firefox for Android, Firefox Focus, or Thunderbird. The CVSS score is 8.8 because exploitation is network-reachable, requires no privileges, requires user interaction, and can result in loss of confidentiality, integrity, and availability. Mozilla reported active exploitation in the wild, and the vulnerability is listed in CISA KEV with a remediation deadline of 2022-03-21.

Why it matters to the business

An attacker can use a malicious website, link, or content rendered by an affected Mozilla application to compromise a user endpoint. If exploited successfully, the attacker may steal browser or mail data, run code as the user, deploy additional malware, or pivot further if combined with a sandbox escape or local privilege escalation. Because this vulnerability is known to have been exploited in the wild and has been in KEV for years, any remaining vulnerable installations represent high-risk legacy exposure, especially in environments where Firefox ESR or Thunderbird are widely deployed.

How an attack unfolds

An attacker prepares malicious web or document content that exercises Mozilla’s XSLT processing logic and removes an XSLT parameter at a carefully chosen point to trigger a use-after-free condition. The attacker then shapes memory layout through JavaScript, DOM activity, or repeated allocations so that the freed object is replaced with attacker-controlled data. A victim is lured to a malicious or compromised website, opens a crafted link, or views attacker-controlled content in an affected Mozilla application. When the vulnerable XSLT code path executes, memory corruption occurs and may redirect execution flow to attacker-controlled code. In a browser context, exploitation typically gives code execution inside the application’s sandbox; broader system compromise may require chaining with another vulnerability, credential theft, user-token abuse, or post-exploitation tooling. Active exploitation has been reported, so investigations should treat unexplained Mozilla crashes followed by suspicious child processes, downloads, authentication activity, or endpoint alerts as potentially significant.

How to fix it

Upgrade all affected Mozilla products to fixed or later versions: Firefox 97.0.2 or later; Firefox ESR 91.6.1 or later; Firefox for Android 97.3.0 or later; Firefox Focus 97.3.0 or later; Thunderbird 91.6.2 or later. Prefer current supported release branches rather than only the minimum fixed versions, because these older fixed versions are themselves obsolete. Remove unsupported Mozilla versions from managed systems, mobile devices, virtual desktop images, golden images, and software repositories. If immediate patching is not possible, reduce exposure by restricting browsing to trusted sites, disabling or limiting risky content where operationally feasible, using endpoint isolation for legacy systems, blocking known malicious web infrastructure, and ensuring exploit mitigation features, EDR, and application sandboxing remain enabled. Because this vulnerability is in CISA KEV and the remediation due date has long passed, treat unpatched assets as urgent exceptions requiring documented risk acceptance or isolation.

How to confirm the fix worked

Confirm remediation by inventorying installed Mozilla application versions and verifying they are at or above the fixed versions: Firefox >= 97.0.2, Firefox ESR >= 91.6.1, Firefox for Android >= 97.3.0, Firefox Focus >= 97.3.0, and Thunderbird >= 91.6.2. On managed endpoints, validate through software inventory, package manager output, MDM/UEM reports, vulnerability scanner results, browser update telemetry, and EDR application inventory. Confirm that auto-update policies are enabled and not pinned to vulnerable ESR or legacy releases. For exposure validation, search for vulnerable version strings in asset inventories, browser user-agent telemetry, proxy logs, and endpoint software records. For fix validation, launch the application and verify the reported version from the product UI or command-line/package metadata, then rescan to ensure vulnerability findings are closed.

Typical attack path

1. Attacker identifies users running vulnerable versions of Firefox, Firefox ESR, Firefox Focus, Firefox for Android, or Thunderbird.
2. Attacker hosts or delivers crafted HTML/XML/XSLT content designed to trigger the XSLT parameter use-after-free.
3. Victim visits a malicious or compromised page, clicks a phishing link, or opens attacker-controlled content in an affected Mozilla application.
4. The crafted content manipulates XSLT processing and memory layout to trigger memory corruption.
5. Exploit code executes in the context of the affected Mozilla application.
6. Attacker attempts to escape sandbox restrictions, execute payloads, steal data available to the user, or establish persistence using follow-on techniques.
7. Attacker performs post-exploitation actions such as credential theft, command-and-control communication, additional malware deployment, or lateral movement where possible.

How to detect it

To determine whether this vulnerability may already have been exploited, correlate endpoint, browser, proxy, DNS, and crash telemetry for systems that were running vulnerable Mozilla versions. Start with asset inventory to identify historical exposure, then review the period when vulnerable versions were present. Look for Firefox or Thunderbird crashes involving XSLT processing, content-process crashes, or repeated crashes immediately after visits to unfamiliar domains. In EDR telemetry, investigate Mozilla processes spawning unusual child processes such as shells, scripting engines, installers, archive tools, or living-off-the-land binaries. Review file creation events in user download, temporary, startup, browser profile, and mail profile directories shortly after suspicious browsing or email activity. Check proxy and DNS logs for rare newly observed domains, compromised-site redirects, exploit-kit-like URL paths, or unexpected downloads around crash times. For Thunderbird, review whether suspicious messages, attachments, remote content, or links were opened shortly before the event. Because public exploitation details and durable payload indicators are limited, detection should focus on behavioral chains: vulnerable Mozilla version, suspicious web or message content, crash or exploit symptoms, followed by abnormal process execution, persistence, credential access, or command-and-control traffic.

• Firefox/97.0
• Firefox/97.0.1
• Firefox/91.6.0
• Thunderbird/91.6.1
• XSLTProcessor.removeParameter
• removeParameter()
• txMozillaXSLTProcessor::RemoveParameter
• firefox.exe spawning cmd.exe
• firefox.exe spawning powershell.exe
• firefox.exe spawning wscript.exe
• firefox.exe spawning cscript.exe
• firefox.exe spawning mshta.exe
• firefox.exe spawning rundll32.exe
• firefox.exe spawning regsvr32.exe
• thunderbird.exe spawning cmd.exe
• thunderbird.exe spawning powershell.exe
• thunderbird.exe spawning wscript.exe
• thunderbird.exe spawning cscript.exe
• thunderbird.exe spawning mshta.exe
• thunderbird.exe spawning rundll32.exe
• thunderbird.exe spawning regsvr32.exe

What your security team should do

• Immediately identify and update or remove all installations of Firefox below 97.0.2, Firefox ESR below 91.6.1, Firefox for Android below 97.3.0, Firefox Focus below 97.3.0, and Thunderbird below 91.6.2.
• Prioritize remediation on internet-facing workstations, high-privilege user systems, developer workstations, VDI images, email clients, and systems that browse untrusted content.
• Treat any remaining vulnerable installation as a KEV exception because exploitation has been observed in the wild and the CISA due date of 2022-03-21 has long passed.
• Hunt for suspicious Mozilla crashes followed by process creation, script execution, unusual downloads, credential access, or outbound connections to rare domains.
• Review proxy, DNS, EDR, and browser telemetry around users who had vulnerable Mozilla versions installed during the exposure window.
• Ensure Mozilla auto-update is enabled and verify that enterprise policies, package pins, or ESR channel controls are not preventing upgrades.
• Where patching cannot be completed quickly, isolate affected systems, restrict web access, and increase endpoint monitoring until remediation is complete.
• Consider broader compromise assessment if vulnerable systems show crash artifacts, exploit-like browser behavior, or signs of payload execution after visiting unfamiliar web pages.