CVE-2022-31743

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-12-22 · updated 2026-06-17
Weakness: CWE-79

Description

Firefox's HTML parser did not correctly interpret HTML comment tags, resulting in an incongruity with other browsers. This could have been used to escape HTML comments on pages that put user-controlled data in them. This vulnerability affects Firefox < 101.

Affected products

Mozilla Firefox: before 101.0 — fixed in 101.0

How to fix

Upgrade to a fixed version: Mozilla Firefox 101.0. Check the vendor advisory for mitigations.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1747388
https://www.mozilla.org/security/advisories/mfsa2022-20/
https://bugzilla.mozilla.org/show_bug.cgi?id=1747388
https://www.mozilla.org/security/advisories/mfsa2022-20/
https://bugzilla.mozilla.org/show_bug.cgi?id=1747388

Get alerted when CVE-2022-31743 or the next vulnerability affects your stack