CRITICALCVSS 9.6KNOWN EXPLOITED

CVE-2022-26486

CVE-2022-26486 updated by NVD

Published: 2022-03-07
Modified: 2026-09-21
Sources: cisa-kev, nvd

Summary

An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.

References

https://nvd.nist.gov/vuln/detail/CVE-2022-26486

Includes data from the CISA Known Exploited Vulnerabilities catalog.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.