CVE-2022-26486: critical vulnerability in Mozilla Firefox
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
A flaw in Firefox's graphics processing framework allows attackers to exploit freed memory, potentially breaking out of the browser's security sandbox. This critical vulnerability has been actively exploited in real-world attacks.
A malformed WebGPU IPC message triggers a use-after-free condition in the inter-process communication framework, allowing an attacker with local or network access to execute arbitrary code and escape the sandbox. The vulnerability affects multiple Firefox products without user interaction beyond visiting a malicious page.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.