CVE-2022-1529: High severity firefox vulnerability
An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled JavaScript executing in the privileged parent process.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-1529?
CVE-2022-1529 is a vulnerability that allows an attacker to execute attacker-controlled JavaScript in the privileged parent process of Firefox ESR < 91.9.1.
How does CVE-2022-1529 work?
CVE-2022-1529 works by allowing an attacker to send a message to the parent process and use the contents to double-index into a JavaScript object, leading to prototype pollution.
Which software versions are affected by CVE-2022-1529?
CVE-2022-1529 affects Firefox ESR versions < 91.9.1 and Thunderbird versions < 91.9.1.
What is the severity of CVE-2022-1529?
CVE-2022-1529 is classified as a critical vulnerability with a severity score of 8.8.
How can I fix CVE-2022-1529?
To fix CVE-2022-1529, it is recommended to update Firefox ESR to version 91.9.1 or later or Thunderbird to version 91.9.1 or later.