Mozilla Releases Security Update for Firefox and Firefox ESR
Scheduled update for Firefox fixes actively exploited zero-day vulnerabilities
Summary
Scheduled update for Firefox fixes actively exploited zero-day vulnerabilities
Affected platforms
The following platforms are known to be affected:
Threat details
Introduction
Mozilla has released updates for Firefox, Firefox for Android, and Firefox ESR to address two critical vulnerabilities. CVE-2022-26485, a use-after-free in XSLT parameter processing vulnerability, could lead to corruption of valid data, arbitrary code execution, and system crashes. CVE-2022-26486, a use-after-free issue in the WebGPU IPC Framework, could allow an exploitable sandbox escape.
Both of these vulnerabilities are being exploited in the wild and could be used by an attacker to take control of an affected system. CISA have added these zero-day vulnerabilities to their Known Exploited Vulnerabilities Catalog.
Remediation advice
Affected organisations are encouraged to review the Mozilla Foundation Security Advisory 2022-09 and apply the necessary updates.
Definitive source of threat updates
CVE Vulnerabilities
Last edited: 8 March 2022 3:15 pm