CVE-2022-26485
HighExploitedPublic exploitRemoving an XSLT parameter during processing could have lead to an exploitable use-after-free.
Published May 25, 2022 · Updated Aug 19, 2026 · Also known as DEBIAN-CVE-2022-26485, DLA-2933-1, DLA-2939-1, DSA-5090-1, DSA-5094-1, MFSA 2022-09, SUSE-SU-2022:0777-1, SUSE-SU-2022:0778-1, SUSE-SU-2022:0783-1, SUSE-SU-2022:0804-1, TR-22-0200, UBUNTU-CVE-2022-26485, USN-5314-1
Key Facts
Patch immediately- CVE-2022-26485 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting Firefox (Mozilla), Firefox Focus (Mozilla), Firefox Mobile (Mozilla) and 15 more products.
- It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Mar 5, 2022. Public exploit code is available.
- EPSS estimates a 14% probability of exploitation in the next 30 days.
- Fixed versions are available, including Firefox 0:91.7.0-3.el7_9, Firefox 0:91.7.0-3.el8_1, Firefox 1:1snap1-0ubuntu1.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
14%
Higher than 96.5% of all scored CVEs
Exploited in the wild
Yes
4 catalog listings
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2022-26485 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CISA KEV | Mar 7, 2022 | Mar 21, 2022 | Not reported |
| Industry KEV feed | Mar 5, 2022 | Mar 21, 2022 | Not reported |
| CIRCL KEV | Mar 7, 2022 | Mar 21, 2022 | Not reported |
| ENISA EUVD | Mar 7, 2022 | n/a | Not reported |
Required action: Apply updates per vendor instructions.
Affected Products
269 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| FirefoxMozilla | >= unspecified | 97.0.2 |
| Firefox FocusMozilla | >= unspecified | 97.3.0 |
| Firefox MobileMozilla | See advisory | 97.3.0 |
| ThunderbirdMozilla | >= unspecified | 91.6.2 |
| Firefox ESRalpine | >= unspecified | 91.6.1-r0 |
Patched Releases
Firefox
0:91.7.0-3.el7_9, 0:91.7.0-3.el8_1, 1:1snap1-0ubuntu1, 91.7.0-3.0.1.el7_9, 91.7.0-3.0.1.el8_5, 91.7.0-3.el8_5, 91.7.0-3.el8_5.alma, 94.0-r0, 97.0.2-r0, 97.0.2+build1-0ubuntu0.18.04.1, 97.0.2+build1-0ubuntu0.20.04.1, 99.0-1, 97.0.2, 91.6.1, 97.3.0
Firefox ESR
91.6.1, 91.6.1-r0, 91.6.1esr-1, 91.6.1esr-1~deb10u1, 91.6.1esr-1~deb11u1, 91.6.1esr-1~deb9u1
Firefox for Android
97.3.0
Firefox Focus
97.3.0
librewolf
97.0.2-r0
Firefox Mobile
97.3.0
Thunderbird
91.6.2, 0:91.7.0-2.el7_9, 0:91.7.0-2.el8_4, 1:91.6.2-1, 1:91.6.2-1~deb10u1, 1:91.6.2-1~deb11u1, 1:91.6.2-1~deb9u1, 91.6.2-r0, 91.7.0-2.0.1.el7_9, 91.7.0-2.0.1.el8_5, 91.7.0-2.amzn2.0.1, 91.7.0-2.el8_5, 91.7.0-2.el8_5.alma
MozillaFirefox
91.6.1-112.92.1, 91.6.1-150.21.1, 91.6.1-152.19.1, 91.7.0-78.167.1
MozillaFirefox-branding-upstream
91.6.1-152.19.1
MozillaFirefox-devel
91.6.1-112.92.1, 91.6.1-150.21.1, 91.6.1-152.19.1
MozillaFirefox-translations-common
91.6.1-112.92.1, 91.6.1-150.21.1, 91.6.1-152.19.1, 91.7.0-78.167.1
MozillaFirefox-translations-other
91.6.1-150.21.1, 91.6.1-152.19.1, 91.7.0-78.167.1
MozillaThunderbird
91.6.2-8.59.1, 91.7.0-1.1
MozillaThunderbird-translations-common
91.6.2-8.59.1, 91.7.0-1.1
MozillaThunderbird-translations-other
91.6.2-8.59.1, 91.7.0-1.1
mozjs
NA
mozjs-devel
NA
mozjs60
NA
Timeline
Added to Industry KEV feed
Mar 5, 2022
Added to CISA KEV
Mar 7, 2022
Added to CIRCL KEV
Mar 7, 2022
Added to ENISA EUVD
Mar 7, 2022
Publicly disclosed
May 25, 2022
Last updated
Aug 19, 2026
Weakness Type
- CWE-416 Use After Free
References
- advisoryhttp://access.redhat.com/errata/RHSA-2022:0824
- advisoryRHSA-2022:0815
- advisoryRHSA-2022:0816
- advisoryRHSA-2022:0817
- advisoryRHSA-2022:0818
FAQ
Common Questions.
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free.
Affected: Firefox (Mozilla) versions >= unspecified; Firefox Focus (Mozilla) versions >= unspecified; Firefox Mobile (Mozilla), among others. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Mar 5, 2022.
Yes. It was added on Mar 7, 2022 with a federal remediation due date of Mar 21, 2022.
Public exploit code is available.
Fixed versions are available, including Firefox 0:91.7.0-3.el7_9, Firefox 0:91.7.0-3.el8_1, Firefox 1:1snap1-0ubuntu1.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2022-26485 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo