CVE-2022-26486

Timeline

Detection, updates, and resolution for this record.

1. Mar 7, 2022 · Catalog

   Detected

   An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.

2. Mar 7, 2022 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Mar 21, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Aug 19, 2026 · Catalog

   Updated

   An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.

Affected

• cpe mozilla/firefoxversion unspecified
• cpe mozilla/firefox focusversion unspecified
• cpe mozilla/firefox mobileversion unspecified
• cpe mozilla/thunderbirdversion unspecified
• vendor Mozilla Firefoxversion unspecified

Sources

• CISA KEVCVE-2022-26486

  Mozilla Firefox contains a use-after-free vulnerability in WebGPU IPC Framework which can be exploited to perform arbitrary code execution.

  cisa.gov
• CVE.orgCVE-2022-26486

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2022-26486

  30-day exploitation probability 2.4%

  first.org
• NIST NVDCVE-2022-26486

  An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderb

  nvd.nist.gov

References

• Exploit · bugzilla.mozilla.org
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov
• Exploit · mozilla.org