CVE-2025-12380 — Use After Free in Mozilla Firefox

CWE-416 — Use After Free6 documents6 sources
Severity
9.8CRITICALNVD
EPSS
0.1%
top 82.47%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Mozilla Firefox
Timeline
PublishedOct 28

Description

Starting with Firefox 142, it was possible for a compromised child process to trigger a use-after-free in the GPU or browser process using WebGPU-related IPC calls. This may have been usable to escape the child process sandbox. This vulnerability was fixed in Firefox 144.0.2.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

▶NVDmozilla/firefox142.0 — 144.0.2

🔴Vulnerability Details

3
OSV
CVE-2025-12380: Starting with Firefox 142, it was possible for a compromised child process to trigger a use-after-free in the GPU or browser process using WebGPU-rela↗2025-10-28
▶
CVEList
Use-after-free in WebGPU internals triggered from a compromised child process↗2025-10-28
▶
GHSA
GHSA-mmmm-6m78-44q2: Starting with Firefox 142, it was possible for a compromised child process to trigger a use-after-free in the GPU or browser process using WebGPU-rela↗2025-10-28
▶

📋Vendor Advisories

2
Debian
CVE-2025-12380: firefox - Starting with Firefox 142, it was possible for a compromised child process to tr...↗2025
▶
Mozilla
Mozilla Foundation Security Advisory 2025-86: CVE-2025-12380↗
▶
CVE-2025-12380 — Use After Free in Mozilla Firefox | cvebase