Vulnerability Details : CVE-2022-26486
Potential exploit
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
Vulnerability category: Memory Corruption
Products affected by CVE-2022-26486
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:android:*:*
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_focus:*:*:*:*:*:*:*:*
CVE-2022-26486 is in the CISA Known Exploited Vulnerabilities Catalog
CISA vulnerability name:
Mozilla Firefox Use-After-Free Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
Mozilla Firefox contains a use-after-free vulnerability in WebGPU IPC Framework which can be exploited to perform arbitrary code execution.
Notes:
https://nvd.nist.gov/vuln/detail/CVE-2022-26486
Added on
2022-03-07
Action due date
2022-03-21
Exploit prediction scoring system (EPSS) score for CVE-2022-26486
2.81%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 85 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-26486
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.6
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
2.8
|
6.0
|
134c704f-9b21-4f2e-91b3-4a467353bcc0 | 2025-01-28 |
|
9.6
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
2.8
|
6.0
|
NIST |
CWE ids for CVE-2022-26486
-
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.Assigned by:
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
- nvd@nist.gov (Primary)
References for CVE-2022-26486
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1758070
1758070 - (CVE-2022-26486) UAF in Webgpu status manager [exploited in the wild]Exploit;Issue Tracking;Vendor Advisory
-
https://www.mozilla.org/security/advisories/mfsa2022-09/
Security Vulnerabilities fixed in Firefox 97.0.2, Firefox ESR 91.6.1, Firefox for Android 97.3.0, and Focus 97.3.0 — MozillaExploit;Vendor Advisory
Jump to