CVE-2025-12380: Use-after-free in WebGPU internals triggered from a compromised child process
Starting with Firefox 142, it was possible for a compromised child process to trigger a use-after-free in the GPU or browser process using WebGPU-related IPC calls. This may have been usable to escape the child process sandbox.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 144.0.2 - Upgrade
Upgrade
firefoxto a version that resolves this vulnerability.Fixed in 144.0.2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12380?
CVE-2025-12380 has been classified as high severity due to its potential to allow execution of arbitrary code through a use-after-free vulnerability.
How do I fix CVE-2025-12380?
The recommended fix for CVE-2025-12380 is to update Firefox to version 144.0.2 or later.
What platforms are affected by CVE-2025-12380?
CVE-2025-12380 affects all versions of Mozilla Firefox prior to 144.0.2.
What vulnerabilities does CVE-2025-12380 exploit?
CVE-2025-12380 exploits a use-after-free vulnerability triggered by compromised child processes using WebGPU-related IPC calls.
Can CVE-2025-12380 allow attackers to bypass security?
Yes, CVE-2025-12380 may allow attackers to escape the child process sandbox, posing significant security risks.