CVE-2022-26486

State: Published
Severity: 9.6 Critical
Published: Dec 22, 2022
Updated: Oct 21, 2025
Reserved: Mar 4, 2022

Description

An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.

Scores

CVSS	Score	Vector	Source
3.1	9.6 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
FirefoxMozilla	before 97.0.2Affected
Firefox ESRMozilla	before 91.6.1Affected
Firefox for AndroidMozilla	before 97.3.0Affected
ThunderbirdMozilla	before 91.6.2Affected
FocusMozilla	before 97.3.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.