CVE-2022-45421

What it actually does

Memory corruption bugs in the browser and email client rendering engines allow an attacker to overwrite memory and achieve arbitrary code execution with the privileges of the affected process.

Why it matters to the business

Successful exploitation can lead to full compromise of user workstations, theft of credentials and sensitive data, installation of persistent malware, and lateral movement; the vulnerability is nearly four years old with no known active campaigns, reducing immediate organizational risk for patched environments.

How an attack unfolds

An attacker hosts or sends specially crafted web or email content that triggers one of the memory safety issues; with sufficient effort the corruption is turned into code execution, allowing the attacker to run arbitrary payloads on the victim's machine.

How to fix it

Upgrade Mozilla Firefox to version 107 or later, Firefox ESR to 102.5 or later, and Thunderbird to 102.5 or later. Remove or isolate any remaining older installations.

How to confirm the fix worked

Query installed browser and email client versions across the environment and confirm they meet or exceed the fixed releases; re-scan after patch deployment to verify absence of vulnerable binaries.

Typical attack path

1. Victim visits attacker-controlled web page or opens malicious email in Thunderbird
2. Crafted content triggers memory corruption in the rendering engine
3. Attacker leverages corruption to execute shellcode or load a payload
4. Payload establishes persistence or exfiltrates data

How to detect it

Examine web proxy, browser crash, and email client logs for repeated crashes or unusual process terminations on systems still running vulnerable versions; correlate with network traffic to unknown domains around the time of any anomalies.

What your security team should do

• Prioritize patching any remaining Firefox ESR, Firefox, or Thunderbird instances below the fixed versions
• Enable automatic updates for Mozilla products where possible
• Review browser extension and email attachment handling policies to reduce attack surface