CVE-2022-26486
Published: 22 December 2022
Summary
CVE-2022-26486 is a critical-severity Use After Free (CWE-416) vulnerability in Mozilla Firefox. Its CVSS base score is 9.6 (Critical).
Operationally, ranked in the top 14.2% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-10 (Information Input Validation).
Deeper analysis
The vulnerability CVE-2022-26486 is a use-after-free flaw (CWE-416) in the WebGPU IPC framework that can produce an exploitable sandbox escape. It affects Firefox versions before 97.0.2, Firefox ESR before 91.6.1, Firefox for Android before 97.3.0, Thunderbird before 91.6.2, and Focus before 97.3.0.
An attacker can trigger the flaw by delivering an unexpected IPC message, enabling a sandbox escape with high impact on confidentiality, integrity, and availability. The attack requires user interaction over the network and has been observed in real-world exploitation.
Mozilla addressed the issue in advisory MFSA2022-09 by releasing the fixed versions listed above; the CVE is also tracked in the CISA known exploited vulnerabilities catalog.
The EPSS score rose from a low baseline to a peak of 0.0560 before receding to the current value of 0.0253, aligning with confirmed in-the-wild attacks after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-31044
Vulnerability details
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox…
more
for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
- CWE(s)
- KEV Date Added
- 07 March 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires applying the vendor patches that eliminate the use-after-free in the WebGPU IPC path before exploitation can occur.
Mandates validation and sanitization of all input messages, which would have rejected the unexpected IPC message that triggers the UAF condition.
Requires memory-safety protections that reduce the likelihood a use-after-free can be turned into a reliable sandbox escape.