CVE-2022-26486
published 2022-12-22CVE-2022-26486: An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild…
PriorityP181critical9.6CVSS 3.1
AVNACLPRNUIRSCCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2022-03-21
Exploited in the wild
EPSS
2.35%
81.7th percentile
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | < firefox 99.0-1 (sid) | firefox 99.0-1 (sid) |
| debian | firefox-esr | < firefox 99.0-1 (sid) | firefox 99.0-1 (sid) |
| debian | thunderbird | < firefox 99.0-1 (sid) | firefox 99.0-1 (sid) |
| mozilla | firefox | < 91.6.1 | 91.6.1 |
| mozilla | firefox | < 97.0.2 | 97.0.2 |
| mozilla | firefox | < 97.3.0 | 97.3.0 |
| mozilla | firefox | — | — |
| mozilla | firefox | >= 0 < 97.0.2+build1-0ubuntu0.18.04.1 | 97.0.2+build1-0ubuntu0.18.04.1 |
| mozilla | firefox | >= 0 < 97.0.2+build1-0ubuntu0.20.04.1 | 97.0.2+build1-0ubuntu0.20.04.1 |
| mozilla | firefox | >= unspecified < 97.0.2 | 97.0.2 |
| mozilla | firefox_esr | >= unspecified < 91.6.1 | 91.6.1 |
| mozilla | firefox_focus | < 97.3.0 | 97.3.0 |
| mozilla | firefox_for_android | >= unspecified < 97.3.0 | 97.3.0 |
| mozilla | focus | >= unspecified < 97.3.0 | 97.3.0 |
| mozilla | thunderbird | < 91.6.2 | 91.6.2 |
| mozilla | thunderbird | >= 0 < 1:91.6.2-1~deb11u1 | 1:91.6.2-1~deb11u1 |
| mozilla | thunderbird | >= 0 < 1:91.6.2-1 | 1:91.6.2-1 |
| mozilla | thunderbird | >= 0 < 1:91.6.2-1 | 1:91.6.2-1 |
| mozilla | thunderbird | >= 0 < 1:91.6.2-1 | 1:91.6.2-1 |
| mozilla | thunderbird | >= unspecified < 91.6.2 | 91.6.2 |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2022-26486 was exploited in the wild as part of a chained exploit; the vulnerability involves an unexpected message in the WebGPU IPC framework triggering a use-after-free and sandbox escape in Firefox < 97.0.2 / ESR < 91.6.1 ↗
- →The vulnerability was chained with at least two additional flaws; a compromised content process was used to reach the GPU/parent process via WebGPU IPC even when the dom.webgpu.enabled pref is disabled ↗
- →Attack vector: a compromised content process sends unexpected IPC messages to the GPU or parent process to trigger WebGPU code paths; monitor for unexpected PWebGPUParent actor creation, especially when dom.webgpu.enabled is false ↗
- →The specific IPC entry point abused is ContentCompositorBridgeParent::AllocPWebGPUParent (Firefox 98) and CanvasManagerParent (Firefox 99+); detection should focus on WebGPU IPC message handling in the parent/GPU process from a sandboxed content process ↗
- →Patch fix location: gfx/ipc/CanvasManagerParent.cpp — monitor for exploitation attempts targeting this file's IPC message dispatch logic ↗
- ·The WebGPU pref (dom.webgpu.enabled) was disabled by default on all Firefox channels at the time of exploitation; the vulnerability allowed attackers to bypass this pref-based mitigation entirely via IPC, so pref-off status does NOT protect unpatched versions ↗
- ·Fixed versions are Firefox 97.0.2, Firefox ESR 91.6.1, Firefox for Android 97.3, Focus 97.3, and Thunderbird 91.6.2; Red Hat Enterprise Linux 9 packages are listed as not affected ↗
CVSS provenance
nvdv3.19.6CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
osv9.6CRITICAL
vulncheck9.6CRITICAL
cisa9.6CRITICAL
vendor_debian9.6CRITICAL
vendor_redhat9.6CRITICAL
vendor_ubuntu8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Mozilla Firefox Use-After-Free Vulnerability
cisa·2022-03-07·CVSS 9.6
CVE-2022-26486 [CRITICAL] CWE-416 Mozilla Firefox Use-After-Free Vulnerability
Vulnerability: Mozilla Firefox Use-After-Free Vulnerability
Affected: Mozilla Firefox
Mozilla Firefox contains a use-after-free vulnerability in WebGPU IPC Framework which can be exploited to perform arbitrary code execution.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2022-26486
Remediation Due Date: 2022-03-21
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2022-03-06·CVSS 8.8
CVE-2022-26485 [HIGH] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Firefox could be made to crash or run programs as your login if it
opened a malicious website.
A use-after-free was discovered when removing an XSLT parameter in some
circumstances. If a user were tricked into opening a specially crafted
website, an attacker could exploit this to cause a denial of service, or
execute arbitrary code. (CVE-2022-26485)
A use-after-free was discovered in the WebGPU IPC framework. If a user
were tricked into opening a specially crafted website, an attacker could
exploit this to cause a denial of service, or execute arbitrary code.
(CVE-2022-26486)
Instructions: After a standard system update you need to restart Firefox to make
all the necessary changes.
Red Hat
Mozilla: Use-after-free in WebGPU IPC Framework
vendor_redhat·2022-03-05·CVSS 9.6
CVE-2022-26486 [CRITICAL] CWE-416 Mozilla: Use-after-free in WebGPU IPC Framework
Mozilla: Use-after-free in WebGPU IPC Framework
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
An unexpected message in the WebGPU IPC framework could lead to an exploitable sandbox escape and a use-after-free issue. An attacker with enough privileges could exploit this flaw leading to a complete system compromise
Package: firefox (Red Hat Enterprise Linux 6) - Out of support scope
Package: thunderbird (Red Hat Enterprise Linux 6) - Out of support scope
Package: firefox:flatpak/firefox (Red Hat Enterprise Linux 8) - Affect
Debian
CVE-2022-26486: firefox - An unexpected message in the WebGPU IPC framework could lead to a use-after-free...
vendor_debian·2022·CVSS 9.6
CVE-2022-26486 [CRITICAL] CVE-2022-26486: firefox - An unexpected message in the WebGPU IPC framework could lead to a use-after-free...
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
Scope: local
sid: resolved (fixed in 99.0-1)
Mozilla
Mozilla Foundation Security Advisory 2022-09: CVE-2022-26486
vendor_mozilla·CVSS 9.6
CVE-2022-26486 [CRITICAL] Mozilla Foundation Security Advisory 2022-09: CVE-2022-26486
Mozilla Foundation Security Advisory 2022-09
CVE: CVE-2022-26486
Product: Firefox, Firefox ESR, Firefox for Android, Focus, Thunderbird
Impact: critical
Fixed in: Firefox 97.0.2
Firefox ESR 91.6.1
Firefox for Android 97.3
Focus 97.3
Thunderbird 91.6.2
OSV
CVE-2022-26486: An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape
osv·2022-12-22·CVSS 9.6
CVE-2022-26486 [CRITICAL] CVE-2022-26486: An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
GHSA
GHSA-h9vh-vxg7-xmhh: An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape
ghsa_unreviewed·2022-12-22
CVE-2022-26486 [CRITICAL] CWE-416 GHSA-h9vh-vxg7-xmhh: An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
OSV
firefox vulnerabilities
osv·2022-03-06·CVSS 8.8
CVE-2022-26485 [HIGH] firefox vulnerabilities
firefox vulnerabilities
A use-after-free was discovered when removing an XSLT parameter in some
circumstances. If a user were tricked into opening a specially crafted
website, an attacker could exploit this to cause a denial of service, or
execute arbitrary code. (CVE-2022-26485)
A use-after-free was discovered in the WebGPU IPC framework. If a user
were tricked into opening a specially crafted website, an attacker could
exploit this to cause a denial of service, or execute arbitrary code.
(CVE-2022-26486)
VulnCheck
Mozilla Firefox Use-After-Free Vulnerability
vulncheck·2022·CVSS 9.6
CVE-2022-26486 [CRITICAL] CWE-416 Mozilla Firefox Use-After-Free Vulnerability
Mozilla Firefox Use-After-Free Vulnerability
Mozilla Firefox contains a use-after-free vulnerability in WebGPU IPC Framework which can be exploited to perform arbitrary code execution.
Affected: Mozilla Firefox
Required Action: Apply updates per vendor instructions.
Exploitation References: https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://raw.githubusercontent.com/blackorbird/APT_REPORT/master/summary/2023/360_APT_Annual_Research_Report_2022.pdf
Remediation Due: 2022-03-21
No detection rules found.
No public exploits indexed.
https://bugzilla.mozilla.org/show_bug.cgi?id=1758070https://www.mozilla.org/security/advisories/mfsa2022-09/https://bugzilla.mozilla.org/show_bug.cgi?id=1758070https://www.mozilla.org/security/advisories/mfsa2022-09/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26486
2022-12-22
Published
2022-03-07
Added to CISA KEV
Exploited in the wild