CVE-2022-28281
HIGH EXPLOITEDFirefox < 99.0 and Firefox ESR < 91.8 - Out-of-bounds Write via WebAuthN Extensions
Title source: llmExploitation Summary
CVE-2022-28281 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including 0vercl0k.
AI-analyzed exploit summary This PoC demonstrates an out-of-bounds write vulnerability in Mozilla Firefox (CVE-2022-28281) triggered by sending an unexpected number of WebAuthN Extensions in a `Register` command from a compromised renderer process. The exploit leads to memory corruption and a potentially exploitable crash.
Description
If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent process, an out of bounds write would have occurred leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8.
Exploits (1)
This PoC demonstrates an out-of-bounds write vulnerability in Mozilla Firefox (CVE-2022-28281) triggered by sending an unexpected number of WebAuthN Extensions in a `Register` command from a compromised renderer process. The exploit leads to memory corruption and a potentially exploitable crash.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H