8.8 High Exploited

CVE-2022-26485 Mozilla Firefox Use-After-Free Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply updates per vendor instructions.

Ransomware campaigns Not observed so far

Weakness CWE-416

Description

Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.

Affected products and versions

Product	Affected versions	Fixed in
Firefox 97.0	earliest → < 97.0.2	97.0.2
Firefox ESR 91.6	earliest → < 91.6.1	91.6.1
Firefox for Android 97.3	earliest → < 97.3.0	97.3.0
Thunderbird 91.6	earliest → < 91.6.2	91.6.2
Focus 97.3	earliest → < 97.3.0	97.3.0

References

www.mozilla.org www.mozilla.org
bugzilla.mozilla.org bugzilla.mozilla.org

Timeline

Published December 22, 2022
Added to the KEV catalogue March 7, 2022
Last modified October 21, 2025

The 2221 CVEs of Firefox →

CVE-2026-120572 Incorrect boundary conditions in the Layout: Block and Inline component 8.8 High CVE-2026-118027 Frame poisoning in the Layout component 9.1 Critical CVE-2026-118024 Use-after-free in the Graphics: Text component 8.8 High CVE-2026-118025 Other issue in the SVG component 8.8 High

Track this CVE