CVE-2022-26486: Firefox WebGPU IPC use-after-free enables sandbox escape

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityConfirmed in-the-wild exploitation, CISA KEV listing and a 9.6 CVSS score with sandbox escape make this an urgent patch.

What it is

An unexpected message in the WebGPU IPC framework triggers a use-after-free in Mozilla Firefox, Firefox ESR, Firefox for Android, Thunderbird and Focus. Mozilla reports attacks in the wild abusing the flaw, and it is listed in CISA KEV, so it is a confirmed exploited issue rather than a theoretical one.

Impact

An attacker can corrupt memory through the freed WebGPU IPC object and escape the browser sandbox, then run code with the privileges of the compromised process. The CVSS vector rates confidentiality, integrity and availability impact as high with scope change.

Attack surface

The vector is network-reachable with no privileges required, but user interaction is required, consistent with a victim opening a crafted page or message that sends the malformed WebGPU IPC message. No authentication is needed on the attacker side.

Exploitation

CISA KEV lists it as exploited in the wild with a 2022-03-21 remediation due date, and Mozilla references are tagged Exploit. EPSS 30-day probability is 0.02349 (82.8th percentile), so exploitation is confirmed but not broadly automated.

What to do

• Update Firefox to 97.0.2 or later, Firefox ESR to 91.6.1 or later, Firefox for Android to 97.3.0 or later, Thunderbird to 91.6.2 or later, and Focus to 97.3.0 or later.
• Verify update compliance across all managed endpoints, including ESR and mobile builds that are often missed.
• If immediate patching is not possible, restrict or disable WebGPU where policy allows and reduce exposure to untrusted web content.
• Track the KEV due date and treat any unpatched instance as an active incident risk.
• Review Mozilla advisory mfsa2022-09 for the vendor's own guidance.

Detection

• Hunt for Firefox, Thunderbird, Focus or Firefox for Android processes crashing or terminating unexpectedly, especially on hosts that browse untrusted content.
• Monitor for child processes or unusual network connections spawned from browser processes, which can indicate sandbox escape and post-exploitation activity.
• Check endpoint inventories for versions below the fixed releases and alert on any host still running them.
• Correlate proxy or DNS logs for known exploit delivery infrastructure if threat intel provides indicators, since the record itself lists none.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.