CVE-2022-26486
CVE-2022-26486
In short
A flaw in Firefox's graphics processing framework allows attackers to exploit freed memory, potentially breaking out of the browser's security sandbox. This critical vulnerability has been actively exploited in real-world attacks.
Technical detail
A malformed WebGPU IPC message triggers a use-after-free condition in the inter-process communication framework, allowing an attacker with local or network access to execute arbitrary code and escape the sandbox. The vulnerability affects multiple Firefox products without user interaction beyond visiting a malicious page.
Summary generated and translated by AI from the official description.
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected products
Mozilla · FirefoxMozilla · Firefox ESRMozilla · Firefox for AndroidMozilla · FocusMozilla · ThunderbirdWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →