CVE-2022-28282

What it actually does

A use-after-free vulnerability triggered via a link with rel="localization" allows destruction of an object during JavaScript execution followed by a reference through a freed pointer, resulting in memory corruption and potential exploitable crash.

Why it matters to the business

Outdated browser and email client deployments face denial-of-service crashes or further compromise that can interrupt user productivity and require emergency patching across large user bases.

How an attack unfolds

An attacker hosts a webpage containing a link with rel="localization", lures a victim into visiting and triggering JavaScript execution that frees an object, then references the dangling pointer to cause a crash that may be turned into code execution.

How to fix it

Upgrade Mozilla Firefox to 99 or later, Firefox ESR to 91.8 or later, and Thunderbird to 91.8 or later; apply vendor patches as soon as they become available.

How to confirm the fix worked

Confirm installed browser and email client versions meet or exceed the fixed releases and verify that crafted localization links no longer produce crashes under controlled testing.

Typical attack path

1. Host malicious page with rel="localization" link
2. Social-engineer victim into visiting the page
3. Trigger JavaScript that destroys the target object
4. Reference the object via the freed pointer
5. Achieve exploitable crash or memory corruption

How to detect it

Inspect browser crash logs and telemetry for use-after-free signatures involving localization objects, review web proxy logs for suspicious rel="localization" requests, and correlate with known exploit hosting domains.

What your security team should do

• Immediately inventory and update all instances of affected Mozilla products
• Block or monitor traffic to domains known to host exploit pages
• Enable automatic updates where possible and enforce via policy
• Review browser crash telemetry for signs of attempted exploitation