CVE-2022-1887 SQL injection in Firefox for iOS

Q: Is CVE-2022-1887 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-1887 exists.

Q: How do I fix CVE-2022-1887?

No fix has been published for CVE-2022-1887 yet. Limit exposure of the affected software until one is available.

Critical 9.8 Published 22 Dec 2022 Updated 16 Apr 2025

Attackers can trigger SQL injection via external search terms in Firefox for iOS, potentially accessing or modifying data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-1887?

CVE-2022-1887 is a critical SQL injection vulnerability in Mozilla Firefox, published on 22 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The search term could have been specified externally to trigger SQL injection. This vulnerability affects Firefox for iOS < 101.

Weakness: CWE-89

Which versions are affected by CVE-2022-1887?

It affects 1 product.

Products include Mozilla Firefox.

How do I fix CVE-2022-1887?

No fix has been published for CVE-2022-1887 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2022-1887 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-1887 exists.

All Mozilla Firefox vulnerabilities

Sources

Also known as GHSA-3f36-r4c3-hh86.