CVE-2022-38474: Mozilla Firefox Mobile

Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days.

A website that had permission to access the microphone could record audio without the audio notification being shown. This bug does not allow the attacker to bypass the permission prompt - it only affects the notification shown once permission has been granted.<br />*This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 104.

Affected products

• Mozilla Firefox Mobile: before 104.0 (fixed in 104.0)

Published 2022-12-22. Last modified 2026-08-19.