CVE-2022-26486: Mozilla Firefox Use-After-Free Vulnerability
First published: Sat Mar 05 2022(Updated: )
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw.
Credit: security@mozilla.org security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/firefox | <0:91.7.0-3.el7_9 | 0:91.7.0-3.el7_9 |
| redhat/thunderbird | <0:91.7.0-2.el7_9 | 0:91.7.0-2.el7_9 |
| redhat/firefox | <0:91.7.0-3.el8_5 | 0:91.7.0-3.el8_5 |
| redhat/thunderbird | <0:91.7.0-2.el8_5 | 0:91.7.0-2.el8_5 |
| redhat/firefox | <0:91.7.0-3.el8_1 | 0:91.7.0-3.el8_1 |
| redhat/thunderbird | <0:91.7.0-2.el8_1 | 0:91.7.0-2.el8_1 |
| redhat/firefox | <0:91.7.0-3.el8_2 | 0:91.7.0-3.el8_2 |
| redhat/thunderbird | <0:91.7.0-2.el8_2 | 0:91.7.0-2.el8_2 |
| redhat/firefox | <0:91.7.0-3.el8_4 | 0:91.7.0-3.el8_4 |
| redhat/thunderbird | <0:91.7.0-2.el8_4 | 0:91.7.0-2.el8_4 |
| Mozilla Firefox | <97.0.2 | 97.0.2 |
| Mozilla Firefox ESR | <91.6.1 | 91.6.1 |
| All of | ||
| Mozilla Firefox | =97.3 | |
| Google Android | ||
| Mozilla Focus | <97.3 | 97.3 |
| Mozilla Thunderbird | <91.6.2 | 91.6.2 |
| redhat/Firefox | <97.0.2 | 97.0.2 |
| redhat/Firefox ESR | <91.6.1 | 91.6.1 |
| redhat/Thunderbird | <91.6.2 | 91.6.2 |
| Mozilla Firefox | <97.0.2 | |
| Mozilla Firefox | <97.3.0 | |
| Mozilla Firefox ESR | <91.6.1 | |
| Mozilla Firefox Focus | <97.3.0 | |
| Mozilla Thunderbird | <91.6.2 | |
| Mozilla Firefox | ||
| <97.0.2 | ||
| <97.3.0 | ||
| <91.6.1 | ||
| <97.3.0 | ||
| <91.6.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2022-26486 https://nvd.nist.gov/vuln/detail/CVE-2022-26486
- https://bugzilla.redhat.com/show_bug.cgi?id=2061735
- https://access.redhat.com/errata/RHSA-2022:0824
- https://access.redhat.com/errata/RHSA-2022:0850
- https://access.redhat.com/errata/RHSA-2022:0818
- https://access.redhat.com/errata/RHSA-2022:0845
- https://access.redhat.com/errata/RHSA-2022:0815
- https://access.redhat.com/errata/RHSA-2022:0847
- https://access.redhat.com/errata/RHSA-2022:0816
- https://access.redhat.com/errata/RHSA-2022:0843
- https://access.redhat.com/errata/RHSA-2022:0817
- https://access.redhat.com/errata/RHSA-2022:0853
- https://access.redhat.com/security/cve/cve-2022-26486
- https://bugzilla.mozilla.org/show_bug.cgi?id=1758070
- https://www.mozilla.org/en-US/security/advisories/mfsa2022-09/
- https://www.mozilla.org/en-US/security/advisories/mfsa2022-09/#CVE-2022-26486
- https://www.mozilla.org/security/advisories/mfsa2022-09/
- https://nvd.nist.gov/vuln/detail/CVE-2022-26486
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2022-26486?
CVE-2022-26486 is a use-after-free vulnerability in Mozilla Firefox.
How severe is the CVE-2022-26486 vulnerability?
The CVE-2022-26486 vulnerability has a severity rating of 9.6 out of 10, which is considered critical.
Which software versions are affected by CVE-2022-26486?
The CVE-2022-26486 vulnerability affects Firefox versions prior to 97.0.2, Firefox ESR versions prior to 91.6.1, Firefox for Android versions prior to 97.3.0, Thunderbird versions prior to 91.6.2, and Mozilla Focus versions prior to 97.3.0.
How can I fix the CVE-2022-26486 vulnerability?
To fix the CVE-2022-26486 vulnerability, you should update Mozilla Firefox to version 97.0.2 or later, Firefox ESR to version 91.6.1 or later, Firefox for Android to version 97.3.0 or later, Thunderbird to version 91.6.2 or later, and Mozilla Focus to version 97.3.0 or later.
Where can I find more information about CVE-2022-26486?
More information about CVE-2022-26486 can be found in the Mozilla Bugzilla and Mozilla Security Advisories.
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- collector/mozilla-advisory
- agent/software-canonical-lookup-request
- agent/title
- agent/severity
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-26486
- agent/software-canonical-lookup
- agent/description
- source/Mozilla
- agent/weakness
- collector/nvd-index
- collector/mitre-cve
- source/MITRE
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/references
- agent/author
- agent/softwarecombine
- agent/event
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/last-modified-date
- agent/trending
- package-manager/redhat
- vendor/mozilla
- canonical/mozilla firefox
- canonical/mozilla firefox esr
- version/mozilla firefox/97.3
- vendor/google
- canonical/google android
- canonical/mozilla focus
- canonical/mozilla thunderbird
- canonical/mozilla firefox focus