CVE-2022-28284

SVG's <code>&lt;use&gt;</code> element could have been used to load unexpected content that could have executed script in certain circumstances. While the specification seems to allow this, other browsers do not, and web developers relied on this property for script security so gecko's implementation was aligned with theirs. This vulnerability affects Firefox < 99.

• CWE-116

• https://bugzilla.mozilla.org/show_bug.cgi?id=1754522Issue Tracking, Permissions Required, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-13/Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1754522Issue Tracking, Permissions Required, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-13/Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1754522Issue Tracking, Permissions Required, Vendor Advisory

Published

Dec 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-28278Adobe Photoshop versions 22.5.6 (and earlier) and 23.2.2 (an…7.8
• CVE-2022-28279Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and…7.8
• CVE-2022-2828In affected versions of Octopus Server it is possible to rev…6.5
• CVE-2022-28281If a compromised content process sent an unexpected number o…8.8
• CVE-2022-28282By using a link with <code>rel="localization"</code> a use-a…6.5
• CVE-2022-28283The sourceMapURL feature in devtools was missing security ch…6.5
• CVE-2022-28285When generating the assembly code for <code>MLoadTypedArrayE…6.5
• CVE-2022-28286Due to a layout change, iframe contents could have been rend…5.4
• CVE-2022-28287In unusual circumstances, selecting text could cause text se…6.5
• CVE-2022-28288Mozilla developers and community members Randell Jesup, Seba…8.8
• CVE-2022-28289Mozilla developers and community members Nika Layzell, Andre…8.8
• CVE-2022-2829Cross-site Scripting (XSS) - Stored in GitHub repository yet…5.4