{"id":"CVE-2022-1802","published":"2022-12-22T00:00:00Z","modified":"2025-04-16T15:17:14Z","title":"If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could…","vendor":"Mozilla","product":"Firefox ESR","tier":"core","eol":null,"affectedVersions":[{"vendor":"Mozilla","product":"Firefox ESR","versions":[">= unspecified, < 91.9.1"]},{"vendor":"Mozilla","product":"Firefox","versions":[">= unspecified, < 100.0.2"]},{"vendor":"Mozilla","product":"Firefox for Android","versions":[">= unspecified, < 100.3.0"]},{"vendor":"Mozilla","product":"Thunderbird","versions":[">= unspecified, < 91.9.1"]}],"description":{"text":"If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged context. This vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is an improperly controlled modification of object prototype attributes in Mozilla Firefox ESR, specifically in how JavaScript Array object methods can be corrupted through prototype pollution. An attacker who can exploit this, typically by getting a user to interact with attacker-supplied content over the network without needing credentials, could execute attacker-controlled JavaScript in a privileged browser context.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T05:10:32Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.28493,"percentile":0.98128,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2022-08-15","exploitedFirstSeen":"2022-08-15","ransomware":false,"evidence":[{"url":"https://securelist.com/it-threat-evolution-in-q2-2022-non-mobile-statistics/107133/","date":"2022-08-15"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-1321","name":"Improperly Controlled Modification of Object Prototype Attributes"}],"references":[{"url":"https://www.mozilla.org/security/advisories/mfsa2022-19/","tags":[]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1770137","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-25081","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-25081","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2022-08-20","earliestUrl":"https://github.com/mistymntncop/CVE-2022-1802","repos":[{"name":"mistymntncop/CVE-2022-1802","url":"https://github.com/mistymntncop/CVE-2022-1802","stars":152,"created":"2022-08-20"}]},"first":{"date":"2022-08-20","source":"PoC-in-GitHub","url":"https://github.com/mistymntncop/CVE-2022-1802"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-08-15","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://securelist.com/it-threat-evolution-in-q2-2022-non-mobile-statistics/107133/","provenance":"source"},{"date":"2022-08-20","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/mistymntncop/CVE-2022-1802","provenance":"source"},{"date":"2022-12-22","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-1802","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":65.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1539 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.63,"detail":"percentile 0.9813"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}