CVE-2022-26486: Mozilla Firefox Use-After-Free Vulnerability

Published Mar 5, 2022
·
Updated

An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw.

Other sources

An unexpected message in the WebGPU IPC framework could lead to an exploitable sandbox escape and a use-after-free issue. An attacker with enough privileges could exploit this flaw leading to a complete system compromise

Mozilla Firefox contains a use-after-free vulnerability in WebGPU IPC Framework which can be exploited to perform arbitrary code execution.

— CISA

Affected Software

27 affected componentsFixes available
redhat/firefox<0:91.7.0-3.el7_9
0:91.7.0-3.el7_9
redhat/thunderbird<0:91.7.0-2.el7_9
0:91.7.0-2.el7_9
redhat/firefox<0:91.7.0-3.el8_5
0:91.7.0-3.el8_5
redhat/thunderbird<0:91.7.0-2.el8_5
0:91.7.0-2.el8_5
redhat/firefox<0:91.7.0-3.el8_1
0:91.7.0-3.el8_1
redhat/thunderbird<0:91.7.0-2.el8_1
0:91.7.0-2.el8_1
redhat/firefox<0:91.7.0-3.el8_2
0:91.7.0-3.el8_2
redhat/thunderbird<0:91.7.0-2.el8_2
0:91.7.0-2.el8_2
redhat/firefox<0:91.7.0-3.el8_4
0:91.7.0-3.el8_4
redhat/thunderbird<0:91.7.0-2.el8_4
0:91.7.0-2.el8_4
redhat/Firefox<97.0.2
97.0.2
redhat/Firefox ESR<91.6.1
91.6.1
redhat/Thunderbird<91.6.2
91.6.2
Mozilla Firefox<97.0.2
97.0.2
Mozilla Firefox ESR<91.6.1
91.6.1
All of the following
Mozilla Firefox=97.3
Google Android
Mozilla Focus<97.3
97.3
Mozilla Thunderbird<91.6.2
91.6.2
Mozilla Firefox<97.0.2
Mozilla Firefox Android<97.3.0
Mozilla Firefox ESR<91.6.1
Mozilla Firefox Focus<97.3.0
Mozilla Thunderbird<91.6.2
Mozilla Firefox
Mozilla Firefox<91.6.1
Mozilla Firefox<97.0.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/firefox to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-3.el7_9
  2. Upgrade

    Upgrade redhat/thunderbird to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-2.el7_9
  3. Upgrade

    Upgrade redhat/firefox to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-3.el8_5
  4. Upgrade

    Upgrade redhat/thunderbird to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-2.el8_5
  5. Upgrade

    Upgrade redhat/firefox to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-3.el8_1
  6. Upgrade

    Upgrade redhat/thunderbird to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-2.el8_1
  7. Upgrade

    Upgrade redhat/firefox to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-3.el8_2
  8. Upgrade

    Upgrade redhat/thunderbird to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-2.el8_2
  9. Upgrade

    Upgrade redhat/firefox to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-3.el8_4
  10. Upgrade

    Upgrade redhat/thunderbird to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-2.el8_4
  11. Upgrade

    Upgrade Firefox to a version that resolves this vulnerability.

    Fixed in 97.0.2
  12. Upgrade

    Upgrade Firefox ESR to a version that resolves this vulnerability.

    Fixed in 91.6.1
  13. Upgrade

    Upgrade Mozilla Focus to a version that resolves this vulnerability.

    Fixed in 97.3
  14. Upgrade

    Upgrade Thunderbird to a version that resolves this vulnerability.

    Fixed in 91.6.2
  15. Upgrade

    Upgrade redhat/Firefox to a version that resolves this vulnerability.

    Fixed in 97.0.2
  16. Upgrade

    Upgrade redhat/Firefox ESR to a version that resolves this vulnerability.

    Fixed in 91.6.1
  17. Upgrade

    Upgrade redhat/Thunderbird to a version that resolves this vulnerability.

    Fixed in 91.6.2

Event History

Mar 5, 2022
CVE Published
12:00 AM
Mar 7, 2022
Known Exploited
via CISA·12:00 AM
Mar 8, 2022
Data Sourced
via Red Hat·01:14 PM
DescriptionSeverityAffected Software
Dec 22, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is CVE-2022-26486?

CVE-2022-26486 is a use-after-free vulnerability in Mozilla Firefox.

2

How severe is the CVE-2022-26486 vulnerability?

The CVE-2022-26486 vulnerability has a severity rating of 9.6 out of 10, which is considered critical.

3

Which software versions are affected by CVE-2022-26486?

The CVE-2022-26486 vulnerability affects Firefox versions prior to 97.0.2, Firefox ESR versions prior to 91.6.1, Firefox for Android versions prior to 97.3.0, Thunderbird versions prior to 91.6.2, and Mozilla Focus versions prior to 97.3.0.

4

How can I fix the CVE-2022-26486 vulnerability?

To fix the CVE-2022-26486 vulnerability, you should update Mozilla Firefox to version 97.0.2 or later, Firefox ESR to version 91.6.1 or later, Firefox for Android to version 97.3.0 or later, Thunderbird to version 91.6.2 or later, and Mozilla Focus to version 97.3.0 or later.

5

Where can I find more information about CVE-2022-26486?

More information about CVE-2022-26486 can be found in the Mozilla Bugzilla and Mozilla Security Advisories.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203