CVE-2022-46875

The executable file warning was not presented when downloading .atloc and .ftploc files, which can run commands on a user's computer. <br>*Note: This issue only affected Mac OS operating systems. Other operating systems are unaffected.*. This vulnerability affects Firefox < 108, Firefox ESR < 102.6, and Thunderbird < 102.6.

• CWE-287

• https://bugzilla.mozilla.org/show_bug.cgi?id=1786188Issue Tracking, Permissions Required
• https://security.gentoo.org/glsa/202305-06
• https://security.gentoo.org/glsa/202305-13
• https://www.mozilla.org/security/advisories/mfsa2022-51/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-52/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-53/Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1786188Issue Tracking, Permissions Required
• https://security.gentoo.org/glsa/202305-06
• https://security.gentoo.org/glsa/202305-13
• https://www.mozilla.org/security/advisories/mfsa2022-51/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-52/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-53/Vendor Advisory

Published

Dec 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-4687Incorrect Use of Privileged APIs in GitHub repository usemem…8.1
• CVE-2022-46870An Improper Neutralization of Input During Web Page Generati…5.4
• CVE-2022-46871An out of date library (libusrsctp) contained vulnerabilitie…8.8
• CVE-2022-46872An attacker who compromised a content process could have par…8.6
• CVE-2022-46873Because Firefox did not implement the <code>unsafe-hashes</c…8.8
• CVE-2022-46874A file with a long filename could have had its filename trun…8.8
• CVE-2022-46877By confusing the browser, the fullscreen notification could …4.3
• CVE-2022-46878Mozilla developers Randell Jesup, Valentin Gosu, Olli Pettay…8.8
• CVE-2022-46879Mozilla developers and community members Lukas Bernhard, Gab…8.8
• CVE-2022-4688Improper Authorization in GitHub repository usememos/memos p…8.8
• CVE-2022-46880A missing check related to tex units could have led to a use…6.5
• CVE-2022-46881An optimization in WebGL was incorrect in some cases, and co…8.8