# CVE-2022-26486

An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.

- Page: https://www.vulneraibility.com/cve/CVE-2022-26486
- CVSS: 9.6
- Known exploited: yes, in CISA KEV since 2022-03-07; CISA due date 2022-03-21
- EPSS: 2.36% (percentile 84.0)
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2025-01-28)
- Weakness: CWE-416
- Published: 2022-12-22

## Affected versions

- Mozilla Firefox: affected < 97.0.2
- Mozilla Firefox ESR: affected < 91.6.1
- Mozilla Firefox for Android: affected < 97.3.0
- Mozilla Focus: affected < 97.3.0
- Mozilla Thunderbird: affected < 91.6.2

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://www.mozilla.org/security/advisories/mfsa2022-09/
- [other] https://bugzilla.mozilla.org/show_bug.cgi?id=1758070
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26486

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.