CVE-2022-22758

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-12-22 · updated 2026-06-17
Weakness: CWE-319

Description

When clicking on a tel: link, USSD codes, specified after a <code>\*</code> character, would be included in the phone number. On certain phones, or on certain carriers, if the number was dialed this could perform actions on a user's account, similar to a cross-site request forgery attack.<br>*This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 97.

Affected products

Mozilla Firefox: before 97.0 — fixed in 97.0

How to fix

Upgrade to a fixed version: Mozilla Firefox 97.0. Check the vendor advisory for mitigations.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1728742
https://www.mozilla.org/security/advisories/mfsa2022-04/
https://bugzilla.mozilla.org/show_bug.cgi?id=1728742
https://www.mozilla.org/security/advisories/mfsa2022-04/

Get alerted when CVE-2022-22758 or the next vulnerability affects your stack