CVE-2022-22746: Race Condition

Reference Links

• https://bugzilla.mozilla.org/show_bug.cgi?id=1735071
• https://www.mozilla.org/en-US/security/advisories/mfsa2022-02/
• https://www.mozilla.org/en-US/security/advisories/mfsa2022-01/
• https://www.mozilla.org/en-US/security/advisories/mfsa2022-03/
• https://www.mozilla.org/security/advisories/mfsa2022-01/
• https://www.mozilla.org/security/advisories/mfsa2022-02/
• https://www.mozilla.org/security/advisories/mfsa2022-03/

Parent vulnerabilities

(Appears in the following advisories)

• MFSA2022-02
• MFSA2022-03
• MFSA2022-01

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2022-22746
• CVE-2022-22743
• CVE-2022-22742
• CVE-2022-22741
• CVE-2022-22740
• CVE-2022-22738
• CVE-2022-22737
• CVE-2021-4140
• CVE-2022-22748
• CVE-2022-22745
• CVE-2022-22744
• CVE-2022-22747
• CVE-2022-22739
• CVE-2022-22751
• CVE-2022-22750
• CVE-2022-22749
• CVE-2022-22763
• CVE-2022-22736
• CVE-2022-22752

Frequently Asked Questions

• What is the severity of CVE-2022-22746?

  The severity of CVE-2022-22746 is high, with a severity value of 7.

• Which operating systems are affected by CVE-2022-22746?

  Only Thunderbird for Windows is affected. Other operating systems are unaffected.

• How can CVE-2022-22746 be exploited?

  CVE-2022-22746 can be exploited through a race condition that allows bypassing the fullscreen notification and spoofing a fullscreen window.

• How can I fix CVE-2022-22746?

  To fix CVE-2022-22746, update Thunderbird for Windows to version 91.5 or higher.

• Where can I find more information about CVE-2022-22746?

  You can find more information about CVE-2022-22746 on the Mozilla Bugzilla page (https://bugzilla.mozilla.org/show_bug.cgi?id=1735071) and the Mozilla security advisories (https://www.mozilla.org/en-US/security/advisories/mfsa2022-02/ and https://www.mozilla.org/en-US/security/advisories/mfsa2022-03/).