CVE-2022-22752
Mozilla developers Christian Holler and Jason Kratzer reported memory safety bugs present in...
8.8 HighFix available
Mozilla developers Christian Holler and Jason Kratzer reported memory safety bugs present in Firefox 95. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 96.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
0.56%Down 0.3 points since Dec 23, 2022
What each source reports
NVD Score used
Mozilla developers Christian Holler and Jason Kratzer reported memory safety bugs present in Firefox 95. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 96.
- Record
CVE-2022-22752- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List
Mozilla developers Christian Holler and Jason Kratzer reported memory safety bugs present in Firefox 95. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 96.
- Record
CVE-2022-22752- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2022-27895
Mozilla developers Christian Holler and Jason Kratzer reported memory safety bugs present in Firefox 95. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 96.
- Record
EUVD-2022-27895- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-39fv-f7h5-p7jp
Mozilla developers Christian Holler and Jason Kratzer reported memory safety bugs present in...
Mozilla developers Christian Holler and Jason Kratzer reported memory safety bugs present in Firefox 95. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 96.
- Record
GHSA-39fv-f7h5-p7jp- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSVALPINE-CVE-2022-22752
Mozilla developers Christian Holler and Jason Kratzer reported memory safety bugs present in Firefox 95. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 96.
- Record
ALPINE-CVE-2022-22752- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVUBUNTU-CVE-2022-22752
Mozilla developers Christian Holler and Jason Kratzer reported memory safety bugs present in Firefox 95. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 96.
- Record
UBUNTU-CVE-2022-22752- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11732-1 No score
MozillaFirefox-96.0-1.1 on GA media
These are all security issues fixed in the MozillaFirefox-96.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11732-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score
firefox-esr-128.5.1-1.1 on GA media
These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14572-1- Updated
- 2026-11-02
OSVUSN-5229-1 No score
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, spoof the browser UI, bypass security restrictions, obtain sensitive information across domains, or execute arbitrary code.
- Record
USN-5229-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
firefoxAlpine:v3.16 |
before 97.0-r0 | 97.0-r0 |
firefoxAlpine:v3.17 |
before 97.0-r0 | 97.0-r0 |
firefoxAlpine:v3.18 |
before 97.0-r0 | 97.0-r0 |
firefoxAlpine:v3.19 |
before 97.0-r0 | 97.0-r0 |
firefoxAlpine:v3.20 |
before 97.0-r0 | 97.0-r0 |
firefoxAlpine:v3.21 |
before 97.0-r0 | 97.0-r0 |
firefoxAlpine:v3.22 |
before 97.0-r0 | 97.0-r0 |
firefoxAlpine:v3.23 |
before 97.0-r0 | 97.0-r0 |
librewolfAlpine:v3.21 |
before 97.0-r0 | 97.0-r0 |
librewolfAlpine:v3.22 |
before 97.0-r0 | 97.0-r0 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
librewolfAlpine:v3.23 |
before 97.0-r0 | 97.0-r0 |
librewolfAlpine:v3.24 |
before 97.0-r0 | 97.0-r0 |
firefoxUbuntu:18.04:LTS |
before 96.0+build2-0ubuntu0.18.04.1, plus listed versions 56.0+build6-0ubuntu157.0.1+build2-0ubuntu159.0.1+build1-0ubuntu159.0.2+build1-0ubuntu160.0+build2-0ubuntu1 Show 45 moreShow less60.0.1+build2-0ubuntu0.18.04.160.0.2+build1-0ubuntu0.18.04.161.0+build3-0ubuntu0.18.04.161.0.1+build1-0ubuntu0.18.04.162.0+build2-0ubuntu0.18.04.362.0+build2-0ubuntu0.18.04.462.0+build2-0ubuntu0.18.04.562.0.3+build1-0ubuntu0.18.04.163.0+build2-0ubuntu0.18.04.263.0.3+build1-0ubuntu0.18.04.164.0+build3-0ubuntu0.18.04.165.0+build2-0ubuntu0.18.04.165.0.1+build2-0ubuntu0.18.04.166.0+build3-0ubuntu0.18.04.166.0.1+build1-0ubuntu0.18.04.166.0.2+build1-0ubuntu0.18.04.166.0.3+build1-0ubuntu0.18.04.166.0.4+build3-0ubuntu0.18.04.166.0.5+build1-0ubuntu0.18.04.167.0+build2-0ubuntu0.18.04.167.0.1+build1-0ubuntu0.18.04.167.0.2+build2-0ubuntu0.18.04.167.0.3+build1-0ubuntu0.18.04.167.0.4+build1-0ubuntu0.18.04.168.0+build3-0ubuntu0.18.04.168.0.1+build1-0ubuntu0.18.04.168.0.2+build1-0ubuntu0.18.04.169.0+build2-0ubuntu0.18.04.169.0.1+build1-0ubuntu0.18.04.169.0.2+build1-0ubuntu0.18.04.170.0+build2-0ubuntu0.18.04.170.0.1+build1-0ubuntu0.18.04.171.0+build5-0ubuntu0.18.04.172.0.1+build1-0ubuntu0.18.04.172.0.2+build1-0ubuntu0.18.04.173.0+build3-0ubuntu0.18.04.173.0.1+build1-0ubuntu0.18.04.174.0+build3-0ubuntu0.18.04.174.0.1+build1-0ubuntu0.18.04.175.0+build3-0ubuntu0.18.04.176.0+build2-0ubuntu0.18.04.176.0.1+build1-0ubuntu0.18.04.177.0.1+build1-0ubuntu0.18.04.178.0.1+build1-0ubuntu0.18.04.178.0.2+build2-0ubuntu0.18.04.1 |
96.0+build2-0ubuntu0.18.04.1 |
firefoxUbuntu:20.04:LTS |
before 96.0+build2-0ubuntu0.20.04.1, plus listed versions 69.0.3+build1-0ubuntu170.0+build2-0ubuntu170.0+build2-0ubuntu270.0.1+build1-0ubuntu271.0+build2-0ubuntu2 Show 45 moreShow less71.0+build5-0ubuntu172.0.1+build1-0ubuntu172.0.2+build1-0ubuntu173.0+build1-0ubuntu173.0+build2-0ubuntu173.0+build3-0ubuntu173.0.1+build1-0ubuntu174.0+build1-0ubuntu174.0+build2-0ubuntu174.0+build2-0ubuntu274.0+build3-0ubuntu175.0+build3-0ubuntu176.0+build2-0ubuntu0.20.04.176.0.1+build1-0ubuntu0.20.04.177.0.1+build1-0ubuntu0.20.04.178.0.1+build1-0ubuntu0.20.04.178.0.2+build2-0ubuntu0.20.04.179.0+build1-0ubuntu0.20.04.180.0+build2-0ubuntu0.20.04.180.0.1+build1-0ubuntu0.20.04.181.0+build2-0ubuntu0.20.04.181.0.2+build1-0ubuntu0.20.04.182.0+build2-0ubuntu0.20.04.182.0.2+build1-0ubuntu0.20.04.182.0.3+build1-0ubuntu0.20.04.183.0+build2-0ubuntu0.20.04.184.0+build3-0ubuntu0.20.04.184.0.1+build1-0ubuntu0.20.04.184.0.2+build1-0ubuntu0.20.04.185.0+build1-0ubuntu0.20.04.185.0.1+build1-0ubuntu0.20.04.186.0+build3-0ubuntu0.20.04.186.0.1+build1-0ubuntu0.20.04.187.0+build3-0ubuntu0.20.04.288.0+build2-0ubuntu0.20.04.188.0.1+build1-0ubuntu0.20.04.289.0+build2-0ubuntu0.20.04.289.0.1+build1-0ubuntu0.20.04.189.0.2+build1-0ubuntu0.20.04.190.0+build1-0ubuntu0.20.04.190.0.2+build1-0ubuntu0.20.04.191.0+build2-0ubuntu0.20.04.191.0.1+build1-0ubuntu0.20.04.191.0.2+build1-0ubuntu0.20.04.192.0+build3-0ubuntu0.20.04.1 |
96.0+build2-0ubuntu0.20.04.1 |
firefoxUbuntu:22.04:LTS |
before 96.0+build2-0ubuntu1, plus listed versions 93.0+build1-0ubuntu394.0+build3-0ubuntu194.0.2+build1-0ubuntu194.0.2+build2-0ubuntu195.0+build1-0ubuntu195.0.1+build2-0ubuntu195.0.2+build1-0ubuntu1 |
96.0+build2-0ubuntu1 |
firefoxUbuntu:18.04:LTS From an advisory covering 13 CVEs |
before 96.0+build2-0ubuntu0.18.04.1, plus listed versions 56.0+build6-0ubuntu157.0.1+build2-0ubuntu159.0.1+build1-0ubuntu159.0.2+build1-0ubuntu160.0+build2-0ubuntu1 Show 45 moreShow less60.0.1+build2-0ubuntu0.18.04.160.0.2+build1-0ubuntu0.18.04.161.0+build3-0ubuntu0.18.04.161.0.1+build1-0ubuntu0.18.04.162.0+build2-0ubuntu0.18.04.362.0+build2-0ubuntu0.18.04.462.0+build2-0ubuntu0.18.04.562.0.3+build1-0ubuntu0.18.04.163.0+build2-0ubuntu0.18.04.263.0.3+build1-0ubuntu0.18.04.164.0+build3-0ubuntu0.18.04.165.0+build2-0ubuntu0.18.04.165.0.1+build2-0ubuntu0.18.04.166.0+build3-0ubuntu0.18.04.166.0.1+build1-0ubuntu0.18.04.166.0.2+build1-0ubuntu0.18.04.166.0.3+build1-0ubuntu0.18.04.166.0.4+build3-0ubuntu0.18.04.166.0.5+build1-0ubuntu0.18.04.167.0+build2-0ubuntu0.18.04.167.0.1+build1-0ubuntu0.18.04.167.0.2+build2-0ubuntu0.18.04.167.0.3+build1-0ubuntu0.18.04.167.0.4+build1-0ubuntu0.18.04.168.0+build3-0ubuntu0.18.04.168.0.1+build1-0ubuntu0.18.04.168.0.2+build1-0ubuntu0.18.04.169.0+build2-0ubuntu0.18.04.169.0.1+build1-0ubuntu0.18.04.169.0.2+build1-0ubuntu0.18.04.170.0+build2-0ubuntu0.18.04.170.0.1+build1-0ubuntu0.18.04.171.0+build5-0ubuntu0.18.04.172.0.1+build1-0ubuntu0.18.04.172.0.2+build1-0ubuntu0.18.04.173.0+build3-0ubuntu0.18.04.173.0.1+build1-0ubuntu0.18.04.174.0+build3-0ubuntu0.18.04.174.0.1+build1-0ubuntu0.18.04.175.0+build3-0ubuntu0.18.04.176.0+build2-0ubuntu0.18.04.176.0.1+build1-0ubuntu0.18.04.177.0.1+build1-0ubuntu0.18.04.178.0.1+build1-0ubuntu0.18.04.178.0.2+build2-0ubuntu0.18.04.1 |
96.0+build2-0ubuntu0.18.04.1 |
firefoxUbuntu:20.04:LTS From an advisory covering 13 CVEs |
before 96.0+build2-0ubuntu0.20.04.1, plus listed versions 69.0.3+build1-0ubuntu170.0+build2-0ubuntu170.0+build2-0ubuntu270.0.1+build1-0ubuntu271.0+build2-0ubuntu2 Show 45 moreShow less71.0+build5-0ubuntu172.0.1+build1-0ubuntu172.0.2+build1-0ubuntu173.0+build1-0ubuntu173.0+build2-0ubuntu173.0+build3-0ubuntu173.0.1+build1-0ubuntu174.0+build1-0ubuntu174.0+build2-0ubuntu174.0+build2-0ubuntu274.0+build3-0ubuntu175.0+build3-0ubuntu176.0+build2-0ubuntu0.20.04.176.0.1+build1-0ubuntu0.20.04.177.0.1+build1-0ubuntu0.20.04.178.0.1+build1-0ubuntu0.20.04.178.0.2+build2-0ubuntu0.20.04.179.0+build1-0ubuntu0.20.04.180.0+build2-0ubuntu0.20.04.180.0.1+build1-0ubuntu0.20.04.181.0+build2-0ubuntu0.20.04.181.0.2+build1-0ubuntu0.20.04.182.0+build2-0ubuntu0.20.04.182.0.2+build1-0ubuntu0.20.04.182.0.3+build1-0ubuntu0.20.04.183.0+build2-0ubuntu0.20.04.184.0+build3-0ubuntu0.20.04.184.0.1+build1-0ubuntu0.20.04.184.0.2+build1-0ubuntu0.20.04.185.0+build1-0ubuntu0.20.04.185.0.1+build1-0ubuntu0.20.04.186.0+build3-0ubuntu0.20.04.186.0.1+build1-0ubuntu0.20.04.187.0+build3-0ubuntu0.20.04.288.0+build2-0ubuntu0.20.04.188.0.1+build1-0ubuntu0.20.04.289.0+build2-0ubuntu0.20.04.289.0.1+build1-0ubuntu0.20.04.189.0.2+build1-0ubuntu0.20.04.190.0+build1-0ubuntu0.20.04.190.0.2+build1-0ubuntu0.20.04.191.0+build2-0ubuntu0.20.04.191.0.1+build1-0ubuntu0.20.04.191.0.2+build1-0ubuntu0.20.04.192.0+build3-0ubuntu0.20.04.1 |
96.0+build2-0ubuntu0.20.04.1 |
MozillaFirefoxopenSUSE:Tumbleweed From an advisory covering 18 CVEs |
before 96.0-1.1 | 96.0-1.1 |
firefox-esropenSUSE:Tumbleweed From an advisory covering 1860 CVEs |
before 128.5.1-1.1 | 128.5.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-22752 is a high vulnerability (CVSS 8.8) in Mozilla Firefox, published January 13, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.56%, the 46th percentile. Fixed in firefox 97.0-r0.
References
mozilla.org/security/advisories/mfsa2022-01
bugzilla.mozilla.org/buglist.cgi?bug_id=1741210%2C1742770
nvd.nist.gov/vuln/detail/CVE-2022-22752
github.com/advisories/GHSA-39fv-f7h5-p7jp
security.alpinelinux.org/vuln/CVE-2022-22752
ubuntu.com/security/CVE-2022-22752
Show 194 moreShow less
cve.org/CVERecord?id=CVE-2022-22752
suse.com/security/cve/CVE-2021-4140
lists.opensuse.org/archives/list/[email protected]/thread/3HI2RC7AJAHY74Q6MK7GNGWU6TITB22V
This page doesn't list everything
Left out here: 72 versions and 1,682 references. The JSON record has them.