CVE-2022-22737

Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could have lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.

• CWE-362
• CWE-362

• https://bugzilla.mozilla.org/show_bug.cgi?id=1745874Exploit, Issue Tracking, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-01/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-02/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-03/Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1745874Exploit, Issue Tracking, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-01/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-02/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-03/Vendor Advisory

Published

Dec 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-22731A CWE-22: Improper Limitation of a Pathname to a Restricted …9.8
• CVE-2022-22732A CWE-668: Exposure of Resource to Wrong Sphere vulnerabilit…7.5
• CVE-2022-22733Exposure of Sensitive Information to an Unauthorized Actor v…6.5
• CVE-2022-22734The Simple Quotation WordPress plugin through 1.3.2 does not…6.1
• CVE-2022-22735The Simple Quotation WordPress plugin through 1.3.2 does not…8.8
• CVE-2022-22736If Firefox was installed to a world-writable directory, a lo…7
• CVE-2022-22738Applying a CSS filter effect could have accessed out of boun…8.8
• CVE-2022-22739Malicious websites could have tricked users into accepting l…6.5
• CVE-2022-2274The OpenSSL 3.0.4 release introduced a serious bug in the RS…9.8
• CVE-2022-22740Certain network request objects were freed too early when re…8.8
• CVE-2022-22741When resizing a popup while requesting fullscreen access, th…7.5
• CVE-2022-22742When inserting text while in edit mode, some characters migh…6.5