CVE-2022-1196

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 91.8 Firefox ESR versions prior to 91.8

Description The issue is related to a use-after-free error that occurs after a VR Process is destroyed, potentially leading to a crash. This error can be exploited by a remote attacker to execute arbitrary code. The vulnerability is associated with a memory release error when handling HTML content after the VR process is destroyed. An attacker can create a specially crafted web page, trick the victim into opening it, and cause a use-after-free error, allowing the execution of arbitrary code in the system.

Recommendations For Thunderbird versions prior to 91.8, update to version 91.8 or later to resolve the issue. For Firefox ESR versions prior to 91.8, update to version 91.8 or later to resolve the issue.