CVE-2022-22737

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could have lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362

Affected software

No affected versions have been published.

Timeline

Published
Dec 22, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-227388.8Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-buffer-overflow causing a potentially CVE-2022-227396.5Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol. This vulnerability affectCVE-2022-22749.8The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This isCVE-2022-227408.8Certain network request objects were freed too early when releasing a network request handle. This could have lead to a use-after-free causiCVE-2022-227417.5When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode. This vulnerability afCVE-2022-227426.5When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potentially exploitable craCVE-2022-227434.3When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made the browser unable to lCVE-2022-227448.8The constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped for PowerShell. This could have lead to coCVE-2022-227456.5Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations. This vulnerability affects FirefoxCVE-2022-227465.9A race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window spoof being unnoticedCVE-2022-227476.5After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. This CVE-2022-227486.5Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handling an external URL pr
CVE-2022-22737: High severity, CVSS 7.5 | Vulnix