CVE-2022-26387 — Time-of-check Time-of-use (TOCTOU) Race Condition in Mozilla Firefox
Severity
7.5HIGHNVD
OSV8.8
EPSS
0.1%
top 70.31%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 22
Description
When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.6 | Impact: 5.9
Affected Packages9 packages
🔴Vulnerability Details
7GHSA▶
GHSA-w44g-v7w6-xpcv: When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-↗2022-12-22
OSV▶
CVE-2022-26387: When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-↗2022-12-22
CVEList▶
CVE-2022-26387: When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-↗2022-12-22