Actively exploited in the wild
Mozilla Firefox Use-After-Free Vulnerability
Mozilla - Firefox · Listed in the CISA KEV since 2022-03-07. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2022-26486
CriticalCVSS 9.6KEVExploitation Probability (EPSS)
High risk82th percentile - higher than 82% of all known CVEs
Summary
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. There have been reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
Risk Assessment
An attacker could exploit this vulnerability to escape the browser sandbox, potentially leading to full system compromise. Due to active exploitation, the risk is high.
Recommendation
It is recommended to immediately update all affected Mozilla products to the latest versions that include fixes.
Original NVD description (English source)
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.