CVE-2022-28289

What it actually does

Memory safety bugs causing memory corruption that can be leveraged to execute arbitrary code in the affected process.

Why it matters to the business

Attackers could take control of users' browsers or email clients, leading to data theft, credential compromise, or further network intrusion across widely deployed desktop applications.

How an attack unfolds

An attacker crafts malicious web content or email that triggers one of the memory corruption flaws during parsing or rendering; with sufficient effort the corruption is turned into code execution, though no public exploits or named threat actors are associated with this issue.

How to fix it

Upgrade Mozilla Firefox to version 99 or later, Firefox ESR to 91.8 or later, and Thunderbird to 91.8 or later. Apply updates through the product's built-in updater or package manager as soon as possible.

How to confirm the fix worked

Confirm installed versions meet or exceed Firefox 99, Firefox ESR 91.8, or Thunderbird 91.8; re-test any custom builds or third-party distributions for the memory-safety fixes present in those releases.

Typical attack path

1. Deliver malicious HTML, JavaScript or email content to the victim
2. Victim opens the content in an affected Firefox, Firefox ESR or Thunderbird release
3. Memory corruption is triggered during processing
4. Attacker gains arbitrary code execution within the application process

How to detect it

Review browser and email-client crash logs, process creation events, and network connections initiated shortly after content rendering; look for unexpected child processes or memory-access anomalies originating from the browser or thunderbird binaries.

What your security team should do

• Prioritize patching all Firefox, Firefox ESR and Thunderbird instances to the fixed releases
• Monitor for any new exploit maturity signals given the low but non-zero EPSS score
• Review endpoint detection rules for anomalous browser or mail-client process behavior