9.6
Critical
CVE-2022-26486 Mozilla Firefox Use-After-Free Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply updates per vendor instructions.
Ransomware campaigns
Not observed so far
Weakness
CWE-416
Description
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Firefox 97.0 | earliest → < 97.0.2 | 97.0.2 |
| Firefox ESR 91.6 | earliest → < 91.6.1 | 91.6.1 |
| Firefox for Android 97.3 | earliest → < 97.3.0 | 97.3.0 |
| Thunderbird 91.6 | earliest → < 91.6.2 | 91.6.2 |
| Focus 97.3 | earliest → < 97.3.0 | 97.3.0 |