CVE-2022-26486

What it actually does

CVE-2022-26486 is a use-after-free vulnerability in Mozilla's WebGPU IPC framework. A specially crafted, unexpected IPC message can cause memory to be reused after it has been freed, allowing attacker-controlled memory corruption. In practical terms, exploitation can escape the browser or application sandbox and execute code with the privileges of the affected Firefox, Firefox ESR, Firefox for Android, Thunderbird, or Focus process. Because the CVSS vector requires user interaction, exploitation typically depends on a victim opening a malicious web page, email content, attachment, or link in an affected Mozilla application.

Why it matters to the business

Successful exploitation can allow an attacker to compromise an endpoint through normal browsing or email activity, bypass browser isolation, steal sensitive data, install malware, or use the compromised device for further access into an organization. This vulnerability is known to have been exploited in the wild and is listed in CISA KEV, with a historical federal remediation deadline of 2022-03-21, so any remaining exposure should be treated as high priority despite the age of the issue. Affected products are widely deployed consumer and enterprise applications, increasing the likelihood that unmanaged, legacy, or embedded installations may still exist.

How an attack unfolds

An attacker prepares malicious web or content-delivery infrastructure that triggers the vulnerable WebGPU IPC behavior in an affected Mozilla application. The victim is lured to visit a malicious or compromised website, open attacker-controlled content, or interact with a crafted message or link using a vulnerable version of Firefox, Firefox ESR, Firefox for Android, Thunderbird, or Focus. The malformed IPC message causes a use-after-free condition, giving the attacker a memory-corruption primitive. The exploit then pivots from code execution inside the content process to escaping the sandbox, enabling code execution with the application user's privileges. Post-exploitation activity may include payload download, credential or cookie theft, browser profile access, persistence setup, lateral movement tooling, or installation of additional malware. Mozilla reported exploitation in the wild, so incident responders should assume that exploitation could have been delivered through targeted web or email lures rather than only opportunistic scanning.

How to fix it

Upgrade all affected Mozilla products to fixed or later versions: Firefox 97.0.2 or later, Firefox ESR 91.6.1 or later, Firefox for Android 97.3.0 or later, Thunderbird 91.6.2 or later, and Focus 97.3.0 or later. Prefer current supported releases rather than only the minimum fixed versions, because older branches may contain other resolved security issues. Remove or isolate unsupported Mozilla installations that cannot be upgraded. Enforce centralized browser and mail-client update policies where available. As temporary risk reduction only, restrict access to untrusted websites and attachments, reduce exposure to active web content, and consider disabling experimental graphics/WebGPU-related features where operationally feasible; these mitigations should not be treated as substitutes for patching.

How to confirm the fix worked

Confirm installed versions across managed and unmanaged endpoints using software inventory, EDR asset data, MDM, package management, or application self-reporting. Validate that Firefox is 97.0.2 or later, Firefox ESR is 91.6.1 or later, Firefox for Android is 97.3.0 or later, Thunderbird is 91.6.2 or later, and Focus is 97.3.0 or later. On desktop systems, verify both standard installation paths and user-local installations. Confirm update channels are healthy and that no blocked, pinned, or legacy ESR deployments remain below the fixed versions. For exposure validation, search historical inventory for vulnerable versions during the period after public exploitation was reported and prioritize forensic review for endpoints that browsed suspicious sites or experienced browser crashes while vulnerable.

Typical attack path

1. Identify users likely to run vulnerable Mozilla Firefox, Firefox ESR, Firefox for Android, Thunderbird, or Focus versions.
2. Deliver a malicious link, compromised webpage, advertisement, email, or other content that will be rendered by the vulnerable application.
3. Trigger the unexpected WebGPU IPC message that causes the use-after-free condition.
4. Exploit memory corruption to achieve code execution in the browser or application context.
5. Use the sandbox escape capability to break out of normal content-process restrictions.
6. Run a second-stage payload or execute commands under the victim user's privileges.
7. Access browser or mail profiles, session cookies, saved credentials, local files, or internal resources reachable from the compromised endpoint.
8. Establish persistence, evade detection, or move laterally depending on attacker objectives.

How to detect it

To determine whether exploitation already occurred, correlate software inventory showing vulnerable Mozilla versions with endpoint, crash, web, DNS, and email telemetry. Review Mozilla crash reports, operating system application crash logs, and EDR memory-corruption alerts for Firefox, Thunderbird, Focus, or related content/GPU processes, especially if followed by unusual process creation or network activity. Examine process trees for Mozilla applications spawning command shells, scripting interpreters, installers, curl/wget-like downloaders, PowerShell, rundll32, regsvr32, mshta, certutil, or other living-off-the-land binaries. Review web proxy and DNS logs for suspicious domains visited immediately before a browser crash or payload download. On mail endpoints, inspect suspicious messages or links opened in Thunderbird around the time of compromise. Look for access to browser or mail profile data, cookie stores, credential databases, extension directories, and unexpected archive or exfiltration tooling. Because public reporting does not provide a universal exploit filename, domain, or payload hash for this CVE, detection should focus on vulnerable-version exposure plus post-exploitation behavior rather than a single definitive indicator.

• firefox.exe spawning cmd.exe
• firefox.exe spawning powershell.exe
• firefox.exe spawning pwsh.exe
• firefox.exe spawning wscript.exe
• firefox.exe spawning cscript.exe
• firefox.exe spawning mshta.exe
• firefox.exe spawning rundll32.exe
• firefox.exe spawning regsvr32.exe
• firefox.exe spawning certutil.exe
• firefox.exe spawning curl.exe
• firefox.exe spawning wget.exe
• thunderbird.exe spawning cmd.exe
• thunderbird.exe spawning powershell.exe
• thunderbird.exe spawning pwsh.exe
• thunderbird.exe spawning wscript.exe
• thunderbird.exe spawning cscript.exe
• thunderbird.exe spawning mshta.exe
• thunderbird.exe spawning rundll32.exe
• thunderbird.exe spawning regsvr32.exe
• thunderbird.exe spawning certutil.exe
• thunderbird.exe spawning curl.exe
• thunderbird.exe spawning wget.exe
• plugin-container.exe spawning cmd.exe
• plugin-container.exe spawning powershell.exe
• plugin-container.exe spawning mshta.exe
• EXCEPTION_ACCESS_VIOLATION in firefox.exe
• EXCEPTION_ACCESS_VIOLATION in thunderbird.exe
• WebGPU
• GPU process crash
• Crash reason: EXCEPTION_ACCESS_VIOLATION
• Crash reason: SIGSEGV
• AppData\Roaming\Mozilla\Firefox\Profiles
• AppData\Roaming\Thunderbird\Profiles
• .mozilla/firefox
• Library/Application Support/Firefox/Profiles
• Library/Thunderbird/Profiles

What your security team should do

• Immediately identify and upgrade any remaining affected Mozilla Firefox, Firefox ESR, Firefox for Android, Thunderbird, or Focus installations below the fixed versions.
• Prioritize remediation because the vulnerability is in CISA KEV and has confirmed exploitation in the wild, even though it is not specifically marked as ransomware-associated.
• Hunt for endpoints that ran vulnerable Mozilla versions and showed browser or mail-client crashes followed by unusual child processes, payload downloads, credential-access behavior, or persistence creation.
• Use EDR/SIEM detections for suspicious process trees where firefox.exe, thunderbird.exe, plugin-container.exe, or equivalent Mozilla processes launch shells, scripting engines, installers, archive utilities, or LOLBins.
• Review web proxy, DNS, and endpoint telemetry around the time of browser crashes or user-reported suspicious links for connections to unknown, newly registered, or low-reputation domains.
• Ensure browser and email-client auto-update controls are enabled and monitored, including for user-installed copies outside standard software deployment tooling.
• Block or alert on execution from browser cache, temporary download, and user profile directories where feasible.
• For high-risk users, consider targeted review of browser profiles, cookies, extensions, and saved credentials if exploitation is suspected.