9.6
Critical
Exploited
CVE-2022-26486 Mozilla Firefox Use-After-Free Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply updates per vendor instructions.
Ransomware campaigns
Not observed so far
Weakness
CWE-416
Description
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Firefox 97.0 | earliest → < 97.0.2 | 97.0.2 |
| Firefox ESR 91.6 | earliest → < 91.6.1 | 91.6.1 |
| Firefox for Android 97.3 | earliest → < 97.3.0 | 97.3.0 |
| Thunderbird 91.6 | earliest → < 91.6.2 | 91.6.2 |
| Focus 97.3 | earliest → < 97.3.0 | 97.3.0 |
References
- www.mozilla.org www.mozilla.org
- bugzilla.mozilla.org bugzilla.mozilla.org
Timeline
- Published
- Added to the KEV catalogue
- Last modified