# Mozilla Firefox ESR (en-US) 102.0

Mozilla Firefox ESR (en-US) 102.0, released June 23, 2022, fixes 119 CVEs in Mozilla Firefox ESR (en-US). 2 of them are being exploited (CVE-2022-26485); 2 on CISA KEV. Patch Radar priority: Patch now. The latest Mozilla Firefox ESR (en-US) is 153.7.0, which also fixes every one of these CVEs.

- Web page: https://patchblox.com/security/fix/windows-app/mozilla.firefox.esr-102.0
- Platform: Windows apps
- Released: Jun 23, 2022
- Priority: Patch now (Closes CVE-2022-26485, exploited (CISA KEV))
- CVEs: 119, exploited: 2, on CISA KEV: 2
- Superseded by: [Mozilla Firefox ESR (en-US) 153.7.0](https://patchblox.com/security/data/product/windows-app/mozilla-firefox-esr-en-us.md), the latest version, which also fixes every CVE listed here

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [Mozilla Firefox ESR (en-US)](https://patchblox.com/security/data/product/windows-app/mozilla-firefox-esr-en-us.md) |  | 102.0 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2022-26485](https://patchblox.com/security/data/cve/CVE-2022-26485.md) | Patch now | Mozilla Firefox Use-After-Free Vulnerability | 9.8 | 0.1426 | CISA KEV |
| [CVE-2022-26486](https://patchblox.com/security/data/cve/CVE-2022-26486.md) | Patch now | Mozilla Firefox Use-After-Free Vulnerability | 9.8 | 0.0236 | CISA KEV |
| [CVE-2021-4129](https://patchblox.com/security/data/cve/CVE-2021-4129.md) | Urgent | Mozilla Firefox ESR and 3 others: Out-of-bounds Write | 9.8 | 0.0106 |  |
| [CVE-2022-26384](https://patchblox.com/security/data/cve/CVE-2022-26384.md) | Urgent | Mozilla Thunderbird and 4 others: Protection Mechanism Failure | 9.8 | 0.0097 |  |
| [CVE-2022-26381](https://patchblox.com/security/data/cve/CVE-2022-26381.md) | Urgent | Mozilla Thunderbird and 4 others: Use After Free | 9.8 | 0.0087 |  |
| [CVE-2022-26383](https://patchblox.com/security/data/cve/CVE-2022-26383.md) | Urgent | Mozilla Thunderbird and 4 others: User Interface (UI) Misrepresentation of Critical Information | 9.8 | 0.0073 |  |
| [CVE-2022-26387](https://patchblox.com/security/data/cve/CVE-2022-26387.md) | Urgent | Mozilla Thunderbird and 4 others: Time-of-check Time-of-use (TOCTOU) Race Condition | 9.8 | 0.0066 |  |
| [CVE-2022-2200](https://patchblox.com/security/data/cve/CVE-2022-2200.md) | High | Mozilla Thunderbird and 4 others: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | 9.8 | 0.2394 |  |
| [CVE-2021-38503](https://patchblox.com/security/data/cve/CVE-2021-38503.md) | High | Mozilla Firefox ESR and 3 others: The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass… | 10.0 | 0.0412 |  |
| [CVE-2021-30547](https://patchblox.com/security/data/cve/CVE-2021-30547.md) | High | Chromium: CVE-2021-30547 Out of bounds write in ANGLE | 8.8 | 0.0361 |  |
| [CVE-2022-28281](https://patchblox.com/security/data/cve/CVE-2022-28281.md) | High | Mozilla Thunderbird and 4 others: Out-of-bounds Write | 8.8 | 0.0278 |  |
| [CVE-2022-28282](https://patchblox.com/security/data/cve/CVE-2022-28282.md) | High | Mozilla Thunderbird and 4 others: Use After Free | 8.8 | 0.0218 |  |
| [CVE-2021-43537](https://patchblox.com/security/data/cve/CVE-2021-43537.md) | High | Mozilla Firefox ESR and 3 others: An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory… | 9.8 | 0.0209 |  |
| [CVE-2021-43542](https://patchblox.com/security/data/cve/CVE-2021-43542.md) | High | Mozilla Firefox ESR and 3 others: Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages… | 9.8 | 0.0183 |  |
| [CVE-2021-38504](https://patchblox.com/security/data/cve/CVE-2021-38504.md) | High | Mozilla Firefox ESR and 3 others: When interacting with an HTML input element's file picker dialog with webkitdirectory set, a use-after-free… | 9.8 | 0.0177 |  |
| [CVE-2021-43536](https://patchblox.com/security/data/cve/CVE-2021-43536.md) | High | Mozilla Firefox ESR and 3 others: Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose… | 9.8 | 0.0174 |  |
| [CVE-2021-43539](https://patchblox.com/security/data/cve/CVE-2021-43539.md) | High | Mozilla Firefox ESR and 3 others: Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC… | 9.8 | 0.0173 |  |
| [CVE-2021-43545](https://patchblox.com/security/data/cve/CVE-2021-43545.md) | High | Mozilla Firefox ESR and 3 others: Using the Location API in a loop could have caused severe application hangs and crashes. | 9.8 | 0.0172 |  |
| [CVE-2021-38496](https://patchblox.com/security/data/cve/CVE-2021-38496.md) | High | Mozilla Firefox ESR and 3 others: During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting… | 8.8 | 0.0166 |  |
| [CVE-2021-43541](https://patchblox.com/security/data/cve/CVE-2021-43541.md) | High | Mozilla Firefox ESR and 3 others: When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was… | 9.8 | 0.0163 |  |
| [CVE-2021-38506](https://patchblox.com/security/data/cve/CVE-2021-38506.md) | High | Mozilla Firefox ESR and 3 others: Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning… | 7.5 | 0.0151 |  |
| [CVE-2021-43546](https://patchblox.com/security/data/cve/CVE-2021-43546.md) | High | Mozilla Firefox ESR and 3 others: It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. | 9.8 | 0.0151 |  |
| [CVE-2021-38498](https://patchblox.com/security/data/cve/CVE-2021-38498.md) | High | Mozilla Firefox ESR and 3 others: During process shutdown, a document could have caused a use-after-free of a languages service object,… | 7.5 | 0.0147 |  |
| [CVE-2021-43543](https://patchblox.com/security/data/cve/CVE-2021-43543.md) | High | Mozilla Firefox ESR and 3 others: Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by… | 9.8 | 0.0145 |  |
| [CVE-2021-4140](https://patchblox.com/security/data/cve/CVE-2021-4140.md) | High | Mozilla Firefox ESR and 3 others: XML Injection (aka Blind XPath Injection) | 10.0 | 0.0141 |  |
| [CVE-2022-22744](https://patchblox.com/security/data/cve/CVE-2022-22744.md) | High | Mozilla Firefox ESR and 3 others: Improper Encoding or Escaping of Output | 8.8 | 0.0137 |  |
| [CVE-2021-38500](https://patchblox.com/security/data/cve/CVE-2021-38500.md) | High | Mozilla Firefox ESR and 3 others: Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. | 8.8 | 0.0127 |  |
| [CVE-2021-43534](https://patchblox.com/security/data/cve/CVE-2021-43534.md) | High | Mozilla Firefox ESR and 3 others: Mozilla developers and community members reported memory safety bugs present in Firefox 93 and Firefox… | 8.8 | 0.0125 |  |
| [CVE-2021-38493](https://patchblox.com/security/data/cve/CVE-2021-38493.md) | High | Mozilla Firefox ESR and 3 others: Mozilla developers reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13. | 8.8 | 0.0125 |  |
| [CVE-2021-43538](https://patchblox.com/security/data/cve/CVE-2021-43538.md) | High | Mozilla Firefox ESR and 3 others: By misusing a race in our notification code, an attacker could have forcefully hidden the notification… | 9.8 | 0.0120 |  |
| [CVE-2021-43535](https://patchblox.com/security/data/cve/CVE-2021-43535.md) | High | Mozilla Firefox ESR and 3 others: A use-after-free could have occured when an HTTP2 session object was released on a different thread,… | 8.8 | 0.0115 |  |
| [CVE-2022-31736](https://patchblox.com/security/data/cve/CVE-2022-31736.md) | High | Mozilla Thunderbird and 4 others: Permissive Cross-domain Policy with Untrusted Domains | 9.8 | 0.0111 |  |
| [CVE-2022-34470](https://patchblox.com/security/data/cve/CVE-2022-34470.md) | High | Mozilla Thunderbird and 4 others: Use After Free | 9.8 | 0.0109 |  |
| [CVE-2022-29917](https://patchblox.com/security/data/cve/CVE-2022-29917.md) | High | Mozilla Thunderbird and 4 others: Out-of-bounds Write | 9.8 | 0.0105 |  |
| [CVE-2021-38501](https://patchblox.com/security/data/cve/CVE-2021-38501.md) | High | Mozilla Firefox ESR and 3 others: Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. | 8.8 | 0.0105 |  |
| [CVE-2022-22738](https://patchblox.com/security/data/cve/CVE-2022-22738.md) | High | Mozilla Firefox ESR and 3 others: Out-of-bounds Write | 9.6 | 0.0104 |  |
| [CVE-2022-22740](https://patchblox.com/security/data/cve/CVE-2022-22740.md) | High | Mozilla Firefox ESR and 3 others: Use After Free | 9.6 | 0.0101 |  |
| [CVE-2022-34484](https://patchblox.com/security/data/cve/CVE-2022-34484.md) | High | Mozilla Thunderbird and 4 others: Use After Free | 9.8 | 0.0100 |  |
| [CVE-2022-22756](https://patchblox.com/security/data/cve/CVE-2022-22756.md) | High | Mozilla Firefox ESR and 4 others: Improper Control of Generation of Code ('Code Injection') | 9.6 | 0.0096 |  |
| [CVE-2022-34468](https://patchblox.com/security/data/cve/CVE-2022-34468.md) | High | Mozilla Thunderbird and 4 others: Inclusion of Functionality from Untrusted Control Sphere | 9.8 | 0.0096 |  |
| [CVE-2022-1097](https://patchblox.com/security/data/cve/CVE-2022-1097.md) | High | Mozilla Thunderbird and 4 others: Use After Free | 8.8 | 0.0095 |  |
| [CVE-2022-31747](https://patchblox.com/security/data/cve/CVE-2022-31747.md) | High | Mozilla Thunderbird and 4 others: Improper Restriction of Operations within the Bounds of a Memory Buffer | 9.8 | 0.0094 |  |
| [CVE-2022-22751](https://patchblox.com/security/data/cve/CVE-2022-22751.md) | High | Mozilla Firefox ESR and 3 others: Out-of-bounds Write | 9.6 | 0.0092 |  |
| [CVE-2022-29909](https://patchblox.com/security/data/cve/CVE-2022-29909.md) | High | Mozilla Thunderbird and 4 others: Incorrect Default Permissions | 9.8 | 0.0089 |  |
| [CVE-2022-31737](https://patchblox.com/security/data/cve/CVE-2022-31737.md) | High | Mozilla Thunderbird and 4 others: Out-of-bounds Write | 9.8 | 0.0087 |  |
| [CVE-2022-22742](https://patchblox.com/security/data/cve/CVE-2022-22742.md) | High | Mozilla Firefox ESR and 3 others: Out-of-bounds Read | 9.6 | 0.0085 |  |
| [CVE-2021-38507](https://patchblox.com/security/data/cve/CVE-2021-38507.md) | High | Mozilla Firefox ESR and 3 others: The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded… | 7.5 | 0.0083 |  |
| [CVE-2022-34481](https://patchblox.com/security/data/cve/CVE-2022-34481.md) | High | Mozilla Thunderbird and 4 others: Integer Overflow or Wraparound | 9.8 | 0.0083 |  |
| [CVE-2021-38499](https://patchblox.com/security/data/cve/CVE-2021-38499.md) | High | Mozilla Firefox ESR and 1 other: Mozilla developers reported memory safety bugs present in Firefox 92. | 8.8 | 0.0082 |  |
| [CVE-2022-22760](https://patchblox.com/security/data/cve/CVE-2022-22760.md) | High | Mozilla Firefox ESR and 4 others: Generation of Error Message Containing Sensitive Information | 9.6 | 0.0081 |  |
| [CVE-2021-38494](https://patchblox.com/security/data/cve/CVE-2021-38494.md) | High | Mozilla Firefox ESR and 1 other: Mozilla developers reported memory safety bugs present in Firefox 91. | 8.8 | 0.0081 |  |
| [CVE-2022-28285](https://patchblox.com/security/data/cve/CVE-2022-28285.md) | High | Mozilla Thunderbird and 4 others: Out-of-bounds Read | 8.8 | 0.0079 |  |
| [CVE-2022-22759](https://patchblox.com/security/data/cve/CVE-2022-22759.md) | High | Mozilla Firefox ESR and 4 others: Protection Mechanism Failure | 9.6 | 0.0079 |  |
| [CVE-2022-22761](https://patchblox.com/security/data/cve/CVE-2022-22761.md) | High | Mozilla Firefox ESR and 4 others: Protection Mechanism Failure | 9.6 | 0.0079 |  |
| [CVE-2022-22737](https://patchblox.com/security/data/cve/CVE-2022-22737.md) | High | Mozilla Firefox ESR and 3 others: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | 9.6 | 0.0078 |  |
| [CVE-2022-22748](https://patchblox.com/security/data/cve/CVE-2022-22748.md) | High | Mozilla Firefox ESR and 3 others: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 9.6 | 0.0077 |  |
| [CVE-2022-29916](https://patchblox.com/security/data/cve/CVE-2022-29916.md) | High | Mozilla Thunderbird and 4 others: Exposure of Sensitive Information to an Unauthorized Actor | 9.8 | 0.0076 |  |
| [CVE-2022-22764](https://patchblox.com/security/data/cve/CVE-2022-22764.md) | High | Mozilla Firefox ESR and 4 others: Out-of-bounds Write | 9.6 | 0.0075 |  |
| [CVE-2022-34482](https://patchblox.com/security/data/cve/CVE-2022-34482.md) | High | Mozilla Firefox and 2 others: Unrestricted Upload of File with Dangerous Type | 8.8 | 0.0074 |  |
| [CVE-2022-34483](https://patchblox.com/security/data/cve/CVE-2022-34483.md) | High | Mozilla Firefox and 2 others: Unrestricted Upload of File with Dangerous Type | 8.8 | 0.0074 |  |
| [CVE-2022-28289](https://patchblox.com/security/data/cve/CVE-2022-28289.md) | High | Mozilla Thunderbird and 4 others: Out-of-bounds Write | 8.8 | 0.0074 |  |
| [CVE-2021-29993](https://patchblox.com/security/data/cve/CVE-2021-29993.md) | High | Mozilla Firefox ESR and 1 other: Firefox for Android allowed navigations through the `intent://` protocol, which could be used to cause… | 8.1 | 0.0073 |  |
| [CVE-2022-22739](https://patchblox.com/security/data/cve/CVE-2022-22739.md) | High | Mozilla Firefox ESR and 3 others: Malicious websites could have tricked users into accepting launching a program to handle an external… | 9.6 | 0.0071 |  |
| [CVE-2022-34476](https://patchblox.com/security/data/cve/CVE-2022-34476.md) | High | Mozilla Firefox and 2 others: Improper Input Validation | 9.8 | 0.0071 |  |
| [CVE-2022-31741](https://patchblox.com/security/data/cve/CVE-2022-31741.md) | High | Mozilla Thunderbird and 4 others: Use of Uninitialized Resource | 9.8 | 0.0071 |  |
| [CVE-2022-31739](https://patchblox.com/security/data/cve/CVE-2022-31739.md) | High | Mozilla Thunderbird and 4 others: External Control of File Name or Path | 8.8 | 0.0071 |  |
| [CVE-2022-31748](https://patchblox.com/security/data/cve/CVE-2022-31748.md) | High | Mozilla Firefox ESR and 2 others: Improper Restriction of Operations within the Bounds of a Memory Buffer | 9.8 | 0.0070 |  |
| [CVE-2022-22741](https://patchblox.com/security/data/cve/CVE-2022-22741.md) | High | Mozilla Firefox ESR and 3 others: When resizing a popup while requesting fullscreen access, the popup would have become unable to leave… | 9.6 | 0.0070 |  |
| [CVE-2022-31740](https://patchblox.com/security/data/cve/CVE-2022-31740.md) | High | Mozilla Thunderbird and 4 others: Improper Restriction of Operations within the Bounds of a Memory Buffer | 9.8 | 0.0069 |  |
| [CVE-2022-22743](https://patchblox.com/security/data/cve/CVE-2022-22743.md) | High | Mozilla Firefox ESR and 3 others: When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab… | 9.6 | 0.0069 |  |
| [CVE-2022-22745](https://patchblox.com/security/data/cve/CVE-2022-22745.md) | High | Mozilla Firefox ESR and 3 others: Exposure of Sensitive Information to an Unauthorized Actor | 9.6 | 0.0068 |  |
| [CVE-2022-29912](https://patchblox.com/security/data/cve/CVE-2022-29912.md) | High | Mozilla Thunderbird and 4 others: URL Redirection to Untrusted Site ('Open Redirect') | 9.8 | 0.0068 |  |
| [CVE-2022-22747](https://patchblox.com/security/data/cve/CVE-2022-22747.md) | High | Mozilla Firefox ESR and 3 others: Improper Certificate Validation | 9.6 | 0.0067 |  |
| [CVE-2022-22754](https://patchblox.com/security/data/cve/CVE-2022-22754.md) | High | Mozilla Firefox ESR and 4 others: Incorrect Authorization | 9.6 | 0.0067 |  |
| [CVE-2022-29914](https://patchblox.com/security/data/cve/CVE-2022-29914.md) | High | Mozilla Thunderbird and 4 others: Improper Restriction of Rendered UI Layers or Frames | 9.8 | 0.0066 |  |
| [CVE-2022-22753](https://patchblox.com/security/data/cve/CVE-2022-22753.md) | High | Mozilla Firefox ESR and 4 others: Time-of-check Time-of-use (TOCTOU) Race Condition | 7.1 | 0.0065 |  |
| [CVE-2022-31742](https://patchblox.com/security/data/cve/CVE-2022-31742.md) | High | Mozilla Thunderbird and 4 others: Observable Discrepancy | 9.8 | 0.0063 |  |
| [CVE-2022-22755](https://patchblox.com/security/data/cve/CVE-2022-22755.md) | High | Mozilla Firefox ESR and 2 others: Operation on a Resource after Expiration or Release | 8.8 | 0.0062 |  |
| [CVE-2022-31738](https://patchblox.com/security/data/cve/CVE-2022-31738.md) | High | Mozilla Thunderbird and 4 others: Authentication Bypass by Spoofing | 9.8 | 0.0062 |  |
| [CVE-2022-31744](https://patchblox.com/security/data/cve/CVE-2022-31744.md) | High | Mozilla Thunderbird and 4 others: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 9.8 | 0.0062 |  |
| [CVE-2022-29911](https://patchblox.com/security/data/cve/CVE-2022-29911.md) | High | Mozilla Thunderbird and 4 others: Improper Restriction of Rendered UI Layers or Frames | 9.8 | 0.0061 |  |
| [CVE-2022-34472](https://patchblox.com/security/data/cve/CVE-2022-34472.md) | High | Mozilla Thunderbird and 4 others: Improper Check or Handling of Exceptional Conditions | 9.8 | 0.0060 |  |
| [CVE-2022-22763](https://patchblox.com/security/data/cve/CVE-2022-22763.md) | High | Mozilla Firefox ESR and 3 others: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | 9.6 | 0.0060 |  |
| [CVE-2022-28284](https://patchblox.com/security/data/cve/CVE-2022-28284.md) | High | Mozilla Firefox ESR and 2 others: Improper Encoding or Escaping of Output | 8.8 | 0.0059 |  |
| [CVE-2022-28286](https://patchblox.com/security/data/cve/CVE-2022-28286.md) | High | Mozilla Thunderbird and 4 others: Improper Restriction of Rendered UI Layers or Frames | 8.8 | 0.0058 |  |
| [CVE-2022-34480](https://patchblox.com/security/data/cve/CVE-2022-34480.md) | High | Mozilla Firefox and 2 others: Access of Uninitialized Pointer | 8.8 | 0.0058 |  |
| [CVE-2022-34477](https://patchblox.com/security/data/cve/CVE-2022-34477.md) | High | Mozilla Firefox and 2 others: Observable Discrepancy | 7.5 | 0.0057 |  |
| [CVE-2022-0843](https://patchblox.com/security/data/cve/CVE-2022-0843.md) | High | Mozilla Firefox ESR and 2 others: Out-of-bounds Write | 8.8 | 0.0057 |  |
| [CVE-2022-29918](https://patchblox.com/security/data/cve/CVE-2022-29918.md) | High | Mozilla Firefox ESR and 2 others: Mozilla developers Gabriele Svelto, Randell Jesup and the Mozilla Fuzzing Team reported memory safety… | 8.8 | 0.0056 |  |
| [CVE-2022-0511](https://patchblox.com/security/data/cve/CVE-2022-0511.md) | High | Mozilla Firefox ESR and 2 others: Out-of-bounds Write | 8.8 | 0.0056 |  |
| [CVE-2022-22752](https://patchblox.com/security/data/cve/CVE-2022-22752.md) | High | Mozilla Firefox ESR and 1 other: Out-of-bounds Write | 8.8 | 0.0056 |  |
| [CVE-2022-28288](https://patchblox.com/security/data/cve/CVE-2022-28288.md) | High | Mozilla Firefox ESR and 2 others: Out-of-bounds Write | 8.8 | 0.0056 |  |
| [CVE-2022-22736](https://patchblox.com/security/data/cve/CVE-2022-22736.md) | High | Mozilla Firefox ESR and 1 other: Uncontrolled Search Path Element | 7.0 | 0.0025 |  |
| [CVE-2021-38509](https://patchblox.com/security/data/cve/CVE-2021-38509.md) | Routine | Mozilla Firefox ESR and 3 others: Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary… | 6.1 | 0.0176 |  |
| [CVE-2021-38508](https://patchblox.com/security/data/cve/CVE-2021-38508.md) | Routine | Mozilla Firefox ESR and 3 others: By displaying a form validity message in the correct location at the same time as a permission prompt… | 6.1 | 0.0164 |  |
| [CVE-2021-38492](https://patchblox.com/security/data/cve/CVE-2021-38492.md) | Routine | Mozilla Firefox ESR and 3 others: When delegating navigations to the operating system, Firefox would accept the `mk` scheme which might… | 6.5 | 0.0116 |  |
| [CVE-2021-38505](https://patchblox.com/security/data/cve/CVE-2021-38505.md) | Routine | Mozilla Firefox ESR and 3 others: Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record… | 6.5 | 0.0108 |  |
| [CVE-2021-43540](https://patchblox.com/security/data/cve/CVE-2021-43540.md) | Routine | Mozilla Firefox ESR and 1 other: WebExtensions with the correct permissions were able to create and install ServiceWorkers for third-party… | 6.5 | 0.0089 |  |
| [CVE-2021-38491](https://patchblox.com/security/data/cve/CVE-2021-38491.md) | Routine | Mozilla Firefox ESR and 1 other: Mixed-content checks were unable to analyze opaque origins which led to some mixed content being loaded. | 6.5 | 0.0088 |  |
| [CVE-2022-34478](https://patchblox.com/security/data/cve/CVE-2022-34478.md) | Routine | Mozilla Thunderbird and 4 others: URL Redirection to Untrusted Site ('Open Redirect') | 6.5 | 0.0080 |  |
| [CVE-2022-22746](https://patchblox.com/security/data/cve/CVE-2022-22746.md) | Routine | Mozilla Firefox ESR and 3 others: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | 5.9 | 0.0062 |  |
| [CVE-2022-34475](https://patchblox.com/security/data/cve/CVE-2022-34475.md) | Routine | Mozilla Firefox and 2 others: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 6.1 | 0.0061 |  |
| [CVE-2022-22750](https://patchblox.com/security/data/cve/CVE-2022-22750.md) | Routine | Mozilla Firefox ESR and 1 other: By generally accepting and passing resource handles across processes, a compromised content process might… | 6.5 | 0.0060 |  |
| [CVE-2022-28283](https://patchblox.com/security/data/cve/CVE-2022-28283.md) | Routine | Mozilla Firefox ESR and 2 others: Files or Directories Accessible to External Parties | 6.5 | 0.0060 |  |
| [CVE-2021-38497](https://patchblox.com/security/data/cve/CVE-2021-38497.md) | Routine | Mozilla Firefox ESR and 3 others: Through use of reportValidity() and window.open(), a plain-text validation message could have been overlaid… | 6.5 | 0.0059 |  |
| [CVE-2022-26385](https://patchblox.com/security/data/cve/CVE-2022-26385.md) | Routine | Mozilla Firefox ESR and 2 others: Use After Free | 6.5 | 0.0058 |  |
| [CVE-2022-28287](https://patchblox.com/security/data/cve/CVE-2022-28287.md) | Routine | Mozilla Firefox ESR and 2 others: Improper Control of a Resource Through its Lifetime | 6.5 | 0.0057 |  |
| [CVE-2021-43533](https://patchblox.com/security/data/cve/CVE-2021-43533.md) | Routine | Mozilla Firefox ESR and 1 other: When parsing internationalized domain names, high bits of the characters in the URLs were sometimes stripped,… | 4.3 | 0.0056 |  |
| [CVE-2021-43532](https://patchblox.com/security/data/cve/CVE-2021-43532.md) | Routine | Mozilla Firefox ESR and 1 other: The 'Copy Image Link' context menu action would copy the final image URL after redirects. | 6.1 | 0.0055 |  |
| [CVE-2022-26382](https://patchblox.com/security/data/cve/CVE-2022-26382.md) | Routine | Mozilla Firefox ESR and 2 others: Observable Discrepancy | 4.3 | 0.0051 |  |
| [CVE-2022-31743](https://patchblox.com/security/data/cve/CVE-2022-31743.md) | Routine | Mozilla Firefox ESR and 2 others: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 6.5 | 0.0046 |  |
| [CVE-2022-22749](https://patchblox.com/security/data/cve/CVE-2022-22749.md) | Routine | Mozilla Firefox ESR and 1 other: Improper Input Validation | 4.3 | 0.0044 |  |
| [CVE-2022-34474](https://patchblox.com/security/data/cve/CVE-2022-34474.md) | Routine | Mozilla Firefox and 2 others: URL Redirection to Untrusted Site ('Open Redirect') | 6.1 | 0.0042 |  |
| [CVE-2022-34473](https://patchblox.com/security/data/cve/CVE-2022-34473.md) | Routine | Mozilla Firefox and 2 others: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 6.1 | 0.0039 |  |
| [CVE-2022-31745](https://patchblox.com/security/data/cve/CVE-2022-31745.md) | Routine | Mozilla Firefox ESR and 2 others: Improper Validation of Array Index | 4.3 | 0.0037 |  |
| [CVE-2021-43531](https://patchblox.com/security/data/cve/CVE-2021-43531.md) | Routine | Mozilla Firefox ESR and 1 other: When a user loaded a Web Extensions context menu, the Web Extension could access the post-redirect URL… | 4.3 | 0.0034 |  |
| [CVE-2022-29915](https://patchblox.com/security/data/cve/CVE-2022-29915.md) | Routine | Mozilla Firefox ESR and 2 others: Origin Validation Error | 4.3 | 0.0030 |  |
| [CVE-2022-34471](https://patchblox.com/security/data/cve/CVE-2022-34471.md) | Routine | Mozilla Firefox and 2 others: Insufficient Verification of Data Authenticity | 6.5 | 0.0025 |  |
| [CVE-2022-22757](https://patchblox.com/security/data/cve/CVE-2022-22757.md) | Routine | Mozilla Firefox ESR and 2 others: Insufficient Verification of Data Authenticity | 6.5 | 0.0025 |  |

---

Data as of 2026-11-11T07:45:43Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.