CVE-2022-26485
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
| Vendor | mozilla |
| Product | firefox |
| Ecosystems | |
| Industries | Technology |
| Published | Dec 22, 2022 |
| Last Updated | Oct 21, 2025 |
⚠️ Actively Exploited — Act Now
Get instant alerts for mozilla firefox
This vulnerability is actively exploited in the wild. Set up free real-time alerts so you're first to know about threats like CVE-2022-26485.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Mozilla / Firefox
unspecified < 97.0.2
Mozilla / Firefox ESR
unspecified < 91.6.1
Mozilla / Firefox for Android
unspecified < 97.3.0
Mozilla / Thunderbird
unspecified < 91.6.2
Mozilla / Focus
unspecified < 97.3.0