CVE-2022-26386

Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in <code>/tmp</code>, but this behavior was changed to download them to <code>/tmp</code> where they could be affected by other local users. This behavior was reverted to the original, user-specific directory. <br>*This bug only affects Firefox for macOS and Linux. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 91.7 and Thunderbird < 91.7.

• CWE-377

• https://bugzilla.mozilla.org/show_bug.cgi?id=1752396Exploit, Issue Tracking, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-11/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-12/Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1752396Exploit, Issue Tracking, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-11/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-12/Vendor Advisory

Published

Dec 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-26380A vulnerability has been identified in SCALANCE X302-7 EEC (…7.5
• CVE-2022-26381An attacker could have caused a use-after-free by forcing a …8.8
• CVE-2022-26382While the text displayed in Autofill tooltips cannot be dire…4.3
• CVE-2022-26383When resizing a popup after requesting fullscreen access, th…4.3
• CVE-2022-26384If an attacker could control the contents of an iframe sandb…9.6
• CVE-2022-26385In unusual circumstances, an individual thread may outlive t…6.5
• CVE-2022-26387When installing an add-on, Firefox verified the signature be…7.5
• CVE-2022-26388A use of hard-coded password vulnerability may allow authent…6.4
• CVE-2022-26389An improper access control vulnerability may allow privilege…7.7
• CVE-2022-2639An integer coercion error was found in the openvswitch kerne…7.8
• CVE-2022-26390The Baxter Spectrum Wireless Battery Module (WBM) stores net…4.2
• CVE-2022-26392The Baxter Spectrum WBM (v16, v16D38) and Baxter Spectrum WB…6.5