CVE-2022-28285

What it actually does

Incorrect AliasSet used when generating assembly for MLoadTypedArrayElementHole leads to out-of-bounds memory read when combined with a second vulnerability.

Why it matters to the business

Attackers may read sensitive memory contents from affected browser processes, potentially exposing user data; organizations must apply updates quickly given public exploit availability and widespread browser deployment.

How an attack unfolds

An attacker delivers malicious JavaScript that triggers the alias-set miscalculation during typed array element loading; combined with a separate flaw, this enables reading memory outside intended bounds.

How to fix it

Upgrade Firefox to 99 or later, Firefox ESR to 91.8 or later, Thunderbird to 91.8 or later. For Wireshark packages apply the listed fixed versions: 3.4.16-0+deb11u1 on Debian 11, 3.6.8-1 on Debian 12/13, and commit 428db086d7910d178a2e137d8ef8d3029aeb6301 or d25900c51508135ac54abfa66a7a07176cdee041 in GIT builds.

How to confirm the fix worked

Confirm browser or Wireshark version numbers match or exceed the fixed releases; re-test any custom builds against the corrected AliasSet logic.

Typical attack path

1. Host a malicious webpage or send HTML email containing crafted JavaScript
2. Victim browser parses and JIT-compiles the typed-array load operation
3. Incorrect AliasSet permits out-of-bounds read during code generation
4. Attacker combines with a second vulnerability to leak memory contents

How to detect it

Review web server or mail logs for requests serving unusual typed-array JavaScript; inspect browser process memory dumps or crash reports indicating out-of-bounds reads; Wireshark users can check packet trace files for anomalous capture handling after upgrade.

What your security team should do

• Apply browser and Wireshark updates immediately due to public exploit availability
• Monitor EPSS trend and re-evaluate risk if score rises
• Block suspicious JavaScript or packet captures that target typed-array handling until patched