CVE-2022-26485 Mozilla Firefox Use-After-Free

Q: Is CVE-2022-26485 being exploited?

Yes. Attackers have exploited CVE-2022-26485 in the wild since at least 7 Mar 2022.

Q: How do I fix CVE-2022-26485?

Upgrade to a fixed version. US federal agencies must fix it by 21 Mar 2022.

Exploited in the wild High 8.8 Published 22 Dec 2022 Updated 21 Oct 2025

Attackers can exploit a use-after-free flaw in XSLT processing to execute arbitrary code, requiring users to upgrade their browsers.

Exploited in the wild: Since 7 Mar 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2022-26485?

CVE-2022-26485 is a high-severity use after free vulnerability in Mozilla Firefox, published on 22 Dec 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.

Weakness: CWE-416

Which versions are affected by CVE-2022-26485?

It affects 4 products.

Products include Mozilla Firefox, Mozilla Firefox Focus, Mozilla Firefox Mobile, Mozilla Thunderbird.

How do I fix CVE-2022-26485?

Upgrade to a fixed version. US federal agencies must fix it by 21 Mar 2022.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2022-26485 being exploited?

Yes. Attackers have exploited CVE-2022-26485 in the wild since at least 7 Mar 2022.

Public exploit code: 1 proofs of concept on GitHub.

All Mozilla Firefox vulnerabilities

Sources

Also known as DEBIAN-CVE-2022-26485, GHSA-rj77-m66j-h24w, UBUNTU-CVE-2022-26485.