Critical · published December 23, 2022
CVSS calls it critical at 9.6. It is confirmed in active exploitation. It sits in the 83.7th percentile for exploit probability.
🚨 A sneaky flaw in the WebGPU IPC framework could let attackers escape their sandbox with a single unexpected message! 🔥 Think of it like a sneaky raccoon finding a way out of a secured garbage bin — one clever twist and it’s free to roam the neighborhood. This vulnerability allows attackers to exploit this escape route to wreak havoc on your system. An attacker could leverage this use-after-free vulnerability to take control of your system, accessing sensitive data and executing malicious code—absolutely devastating! Imagine your locked-up trash can suddenly wide open, letting in all sorts of trouble. Systems running Firefox below 97.0.2, Thunderbird below 91.6.2, and several others are at serious risk here!
Think of it like a sneaky raccoon finding a way out of a secured garbage bin — one clever twist and it’s free to roam the neighborhood. This vulnerability allows attackers to exploit this escape route to wreak havoc on your system. This flaw arises from a use-after-free condition in the WebGPU IPC framework, which can be exploited to escape the sandbox environment, leading to potential full system compromise.
An attacker could leverage this use-after-free vulnerability to take control of your system, accessing sensitive data and executing malicious code—absolutely devastating! Imagine your locked-up trash can suddenly wide open, letting in all sorts of trouble. Systems running Firefox below 97.0.2, Thunderbird below 91.6.2, and several others are at serious risk here! To protect yourself, patch Firefox to version 97.0.2 or later, update Thunderbird to 91.6.2, and ensure your Firefox for Android and Focus are also updated to their respective secure versions. Don't delay — this vulnerability is actively being exploited! You've got this! Follow these steps and you’ll keep the raccoons out of your trash for good! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| mozilla/firefox | < 91.6.1 | 91.6.1 |
| mozilla/firefox | < 97.0.2 | 97.0.2 |
| mozilla/firefox_focus | < 97.3.0 | 97.3.0 |
| mozilla/firefox_mobile | < 97.3.0 | 97.3.0 |
| mozilla/thunderbird | < 91.6.2 | 91.6.2 |