CVE-2022-26387

When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.

• CWE-367
• CWE-367

• https://bugzilla.mozilla.org/show_bug.cgi?id=1752979Exploit, Issue Tracking, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-10/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-11/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-12/Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1752979Exploit, Issue Tracking, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-10/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-11/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-12/Vendor Advisory

Published

Dec 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-26381An attacker could have caused a use-after-free by forcing a …8.8
• CVE-2022-26382While the text displayed in Autofill tooltips cannot be dire…4.3
• CVE-2022-26383When resizing a popup after requesting fullscreen access, th…4.3
• CVE-2022-26384If an attacker could control the contents of an iframe sandb…9.6
• CVE-2022-26385In unusual circumstances, an individual thread may outlive t…6.5
• CVE-2022-26386Previously Firefox for macOS and Linux would download tempor…6.5
• CVE-2022-26388A use of hard-coded password vulnerability may allow authent…6.4
• CVE-2022-26389An improper access control vulnerability may allow privilege…7.7
• CVE-2022-2639An integer coercion error was found in the openvswitch kerne…7.8
• CVE-2022-26390The Baxter Spectrum Wireless Battery Module (WBM) stores net…4.2
• CVE-2022-26392The Baxter Spectrum WBM (v16, v16D38) and Baxter Spectrum WB…6.5
• CVE-2022-26393The Baxter Spectrum WBM is susceptible to format string atta…8.1