Actively exploited in the wild
Mozilla Firefox Use-After-Free Vulnerability
Mozilla - Firefox · Listed in the CISA KEV since 2022-03-07. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2022-26485
HighCVSS 8.8KEVExploitation Probability (EPSS)
Very high risk96th percentile - higher than 96% of all known CVEs
Summary
Removing an XSLT parameter during processing could have led to an exploitable use-after-free. There have been reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
Risk Assessment
An attacker could exploit this vulnerability to execute code in the browser context, potentially leading to system compromise. Due to active exploitation, the risk is high.
Recommendation
It is recommended to immediately update all affected Mozilla products to the latest versions that include fixes.
Original NVD description (English source)
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.