CVE-2022-26485: Firefox XSLT parameter removal use-after-free

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is a remotely reachable use-after-free with confirmed in-the-wild exploitation and KEV listing, though it requires user interaction and patches have long been available.

What it is

Removing an XSLT parameter during processing in Mozilla Firefox could trigger a use-after-free condition. Mozilla reported attacks in the wild abusing this flaw, and it affects Firefox, Firefox ESR, Firefox for Android, Thunderbird and Focus below the fixed versions listed in the advisory. Because it is memory corruption reachable through normal browsing, it is a serious client-side risk.

Impact

An attacker who triggers the use-after-free can corrupt memory and potentially execute arbitrary code in the context of the affected application. Successful exploitation gives code execution on the victim's machine, not just a crash.

Attack surface

The flaw is reached over the network through crafted web content that manipulates XSLT parameters, requiring user interaction such as visiting a page or opening a document. No authentication or privileges are needed on the target; the CVSS vector is AV:N/AC:L/PR:N/UI:R.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2022-03-07 with a 2022-03-21 remediation due date, and Mozilla stated there were reports of in-the-wild attacks. EPSS 30-day probability is 0.14261 (96.4th percentile), and reference tags include Exploit.

What to do

• Update Firefox to 97.0.2 or later, Firefox ESR to 91.6.1 or later, Firefox for Android to 97.3.0 or later, Thunderbird to 91.6.2 or later, and Focus to 97.3.0 or later per Mozilla advisory mfsa2022-09.
• Prioritize patching internet-facing and user workstations that run the affected Mozilla products, given confirmed in-the-wild exploitation.
• Where immediate patching is not possible, reduce exposure by restricting untrusted web content and disabling or limiting XSLT processing in managed browser configurations.
• Track remediation against the CISA KEV due date and verify version compliance across browsers and mail clients.
• Review Mozilla advisory mfsa2022-09 and the Bugzilla issue for any additional vendor guidance.

Detection

• Monitor for crashes of firefox, firefox-esr, thunderbird or focus processes that correlate with visits to untrusted or newly seen domains.
• Hunt endpoint telemetry for suspicious child processes, script interpreters or network connections spawned by browser or mail client processes.
• Check installed versions of Firefox, Firefox ESR, Firefox for Android, Thunderbird and Focus against the fixed versions and alert on any that remain below them.
• Review proxy and DNS logs for access to domains associated with known exploit delivery or watering-hole activity around the exploitation window.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.