Actively exploited · Published Dec 22, 2022 · Assigned by mozilla
CVE-2022-26486
Critical 9.6 Exploited
In plain English
A critical-severity use-after-free in Firefox from Mozilla. Attackers are actively exploiting it in the wild (listed by CISA on March 7, 2022). The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Mar 21, 2022.
Official description
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | firefox | 91.7.0-3.el8_5.alma | ALSA-2022:0818 |
| AlmaLinux:8 | thunderbird | 91.7.0-2.el8_5.alma | ALSA-2022:0845 |
| AlmaLinux:8 | thunderbird | 91.7.0-2.el8_5.alma.plus | ALSA-2022:0845 |
| Alpine:v3.20 | firefox | 97.0.2-r0 | ALPINE-CVE-2022-26486 |
| Alpine:v3.21 | firefox | 97.0.2-r0 | ALPINE-CVE-2022-26486 |
| Alpine:v3.22 | firefox | 97.0.2-r0 | ALPINE-CVE-2022-26486 |
| Alpine:v3.23 | firefox | 97.0.2-r0 | ALPINE-CVE-2022-26486 |
| Alpine:v3.20 | firefox-esr | 91.6.1-r0 | ALPINE-CVE-2022-26486 |
| Alpine:v3.21 | firefox-esr | 91.6.1-r0 | ALPINE-CVE-2022-26486 |
| Alpine:v3.22 | firefox-esr | 91.6.1-r0 | ALPINE-CVE-2022-26486 |
| Alpine:v3.23 | firefox-esr | 91.6.1-r0 | ALPINE-CVE-2022-26486 |
| Alpine:v3.21 | librewolf | 97.0.2-r0 | ALPINE-CVE-2022-26486 |
| Alpine:v3.22 | librewolf | 97.0.2-r0 | ALPINE-CVE-2022-26486 |
| Alpine:v3.23 | librewolf | 97.0.2-r0 | ALPINE-CVE-2022-26486 |
| Alpine:v3.24 | librewolf | 97.0.2-r0 | ALPINE-CVE-2022-26486 |
| Alpine:v3.20 | thunderbird | 91.6.2-r0 | ALPINE-CVE-2022-26486 |
| Alpine:v3.21 | thunderbird | 91.6.2-r0 | ALPINE-CVE-2022-26486 |
| Alpine:v3.22 | thunderbird | 91.6.2-r0 | ALPINE-CVE-2022-26486 |
| Alpine:v3.23 | thunderbird | 91.6.2-r0 | ALPINE-CVE-2022-26486 |
| Debian:12 | firefox-esr | 91.6.1esr-1 | DEBIAN-CVE-2022-26486 |
| Debian:13 | firefox-esr | 91.6.1esr-1 | DEBIAN-CVE-2022-26486 |
| Debian:14 | firefox-esr | 91.6.1esr-1 | DEBIAN-CVE-2022-26486 |
| Debian:12 | thunderbird | 1:91.6.2-1 | DEBIAN-CVE-2022-26486 |
| Debian:13 | thunderbird | 1:91.6.2-1 | DEBIAN-CVE-2022-26486 |
| Debian:14 | thunderbird | 1:91.6.2-1 | DEBIAN-CVE-2022-26486 |
| Rocky Linux:8 | firefox | 0:91.7.0-3.el8_5 | RLSA-2022:0818 |
| Rocky Linux:8 | thunderbird | 0:91.7.0-2.el8_5 | RLSA-2022:0845 |
| Ubuntu:22.04:LTS | firefox | 1:1snap1-0ubuntu1 | UBUNTU-CVE-2022-26486 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | unspecified – before 97.0.2 |
| Mozilla | Firefox ESR | unspecified – before 91.6.1 |
| Mozilla | Firefox for Android | unspecified – before 97.3.0 |
| Mozilla | Thunderbird | unspecified – before 91.6.2 |
| Mozilla | Focus | unspecified – before 97.3.0 |
Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H