CVE-2022-1802Firefox Type Confusion
If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged context.
Published May 31, 2022 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2022-1802, MFSA 2022-19, UBUNTU-CVE-2022-1802
Key Facts
Patch immediately- CVE-2022-1802 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting Firefox (Mozilla), Firefox ESR (Mozilla), Thunderbird (Mozilla) and 16 more products.
- It is exploited in the wild, listed in Industry KEV feed since Aug 15, 2022. A public exploit is reported by tracking sources, but no code link is listed yet.
- EPSS estimates a 27% probability of exploitation in the next 30 days.
- Fixed versions are available, including Firefox 0:91.9.1-1.el7_9, Firefox 0:91.9.1-1.el8_4, Firefox 0:91.9.1-1.el9_0.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Scores
CVSS v3.1
8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
27%
Higher than 98.0% of all scored CVEs
Exploit maturity
Exploited (KEV)
ATLAS score
54/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Aug 15, 2022
76 days after publication
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Exploited (KEV)
Public exploit code
0
Proof-of-concept links
In-the-wild evidence
1
Reports of active use
Advisories And Exploit References
- advisoryhttps://security-tracker.debian.org/tracker/CVE-2022-1802
- advisoryhttps://sensorstechforum.com/cve-2022-1802-cve-2022-1529-firefox/
- advisoryhttps://ubuntu.com/security/CVE-2022-1802
- advisoryhttps://www.cve.org/CVERecord?id=CVE-2022-1802
- advisoryhttps://www.mozilla.org/en-US/security/advisories/mfsa2022-19/#CVE-2022-1802
- advisoryhttp://access.redhat.com/errata/RHSA-2022:4717
Description
If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged context. This vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| Industry KEV feed | Aug 15, 2022 | n/a | Not reported |
Affected Products
298 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| FirefoxMozilla | >= unspecified | 100.0.2 |
| Firefox ESRMozilla | >= unspecified | 91.9.1 |
| ThunderbirdMozilla | >= unspecified | 91.9.1 |
| librewolfalpine | See advisory | 100.0.2-r0 |
| MozillaFirefoxsuse | See advisory | 91.9.1-150200.152.40.1 |
Patched Releases
Firefox
0:91.9.1-1.el7_9, 0:91.9.1-1.el8_4, 0:91.9.1-1.el9_0, 100.0.2-1, 100.0.2-r0, 100.0.2+build1-0ubuntu0.18.04.1, 100.0.2+build1-0ubuntu0.20.04.1, 91.9.1-1.0.1.el7_9, 91.9.1-1.0.1.el8_6, 91.9.1-1.0.1.el9_0, 91.9.1-1.el8_6, 91.9.1-1.el8_6.alma, 94.0-r0, 100.0.2
Firefox ESR
91.9.1, 128.5.1-1.1, 91.9.1-r0, 91.9.1esr-1, 91.9.1esr-1~deb10u1, 91.9.1esr-1~deb11u1, 91.9.1esr-1~deb9u1
Firefox for Android
100.3.0
firefox-esr-branding-upstream
128.5.1-1.1
firefox-esr-translations-common
128.5.1-1.1
firefox-esr-translations-other
128.5.1-1.1
librewolf
100.0.2-r0
Thunderbird
91.9.1, 0:91.9.1-1.el7_9, 0:91.9.1-1.el8_6, 0:91.9.1-1.el9_0, 1:91.10.0-1, 1:91.10.0-1~deb10u1, 1:91.10.0-1~deb11u1, 1:91.10.0-1~deb9u1, 1:91.9.1+build1-0ubuntu0.18.04.1, 1:91.9.1+build1-0ubuntu0.20.04.1, 1:91.9.1+build1-0ubuntu0.22.04.1, 91.9.1-1, 91.9.1-1.0.1.el7_9, 91.9.1-1.0.1.el8_6, 91.9.1-1.0.1.el9_0, 91.9.1-1.amzn2.0.1, 91.9.1-1.el8_6, 91.9.1-1.el8_6.alma, 91.9.1-r0
MozillaFirefox
100.0.2-1.1, 91.9.1-112.111.1, 91.9.1-150000.150.41.1, 91.9.1-150200.152.40.1
MozillaFirefox-branding-upstream
100.0.2-1.1, 91.9.1-150200.152.40.1
MozillaFirefox-devel
100.0.2-1.1, 91.9.1-112.111.1, 91.9.1-150000.150.41.1, 91.9.1-150200.152.40.1
MozillaFirefox-translations-common
100.0.2-1.1, 91.9.1-112.111.1, 91.9.1-150000.150.41.1, 91.9.1-150200.152.40.1
MozillaFirefox-translations-other
100.0.2-1.1, 91.9.1-150000.150.41.1, 91.9.1-150200.152.40.1
MozillaThunderbird
91.10.0-150200.8.73.1, 91.9.1-1.1
MozillaThunderbird-translations-common
91.10.0-150200.8.73.1, 91.9.1-1.1
MozillaThunderbird-translations-other
91.10.0-150200.8.73.1, 91.9.1-1.1
mozjs
NA
mozjs-devel
NA
mozjs60
NA
Timeline
Publicly disclosed
May 31, 2022
Added to Industry KEV feed
Aug 15, 2022
Last updated
Aug 4, 2026
Weakness Type
- CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
- CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
References
- advisorysecurity-tracker.debian.org · CVE-2022-1802
- advisorysensorstechforum.com · CVE-2022-1802
- advisoryubuntu.com · CVE-2022-1802
- advisorycve.org · CVERecord
- advisorymozilla.org · mfsa2022-19
FAQ
Common Questions.
If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged context.
Affected: Firefox (Mozilla) versions >= unspecified; Firefox ESR (Mozilla) versions >= unspecified; Thunderbird (Mozilla) versions >= unspecified, among others. The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed since Aug 15, 2022.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
A public exploit is reported by tracking sources, but no code link is listed yet.
Fixed versions are available, including Firefox 0:91.9.1-1.el7_9, Firefox 0:91.9.1-1.el8_4, Firefox 0:91.9.1-1.el9_0.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2022-1802 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo