CVE-2025-12380
CRITICALCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
Starting with Firefox 142, it was possible for a compromised child process to trigger a use-after-free in the GPU or browser process using WebGPU-related IPC calls. This may have been usable to escape the child process sandbox. This vulnerability was fixed in Firefox 144.0.2.
AnalysisAI
Use-after-free vulnerability in Mozilla Firefox 142 and 143 enables compromised renderer processes to trigger memory corruption in the GPU or browser process via malicious WebGPU IPC calls, potentially achieving sandbox escape. Affecting Firefox versions 142.0 through 144.0.1, this CWE-416 flaw carries CVSS 9.8 despite low real-world exploitation probability (EPSS 0.06%, 18th percentile). No public exploit identified at time of analysis. Patched in Firefox 144.0.2 released January 2025.
Technical ContextAI
WebGPU is a modern graphics API providing GPU access to web content, implemented through a multi-process architecture where untrusted renderer processes communicate with privileged GPU/browser processes via Inter-Process Communication (IPC). This vulnerability stems from CWE-416 (Use After Free), where freed memory objects in the GPU or parent browser process can be accessed through crafted WebGPU IPC messages originating from a compromised child renderer process. The flaw represents a classic sandbox escape primitive: an attacker who has already achieved code execution within Firefox's sandboxed renderer (via a separate memory corruption bug, malicious extension, or social engineering) can leverage this use-after-free to break out of the content process sandbox and execute code in the more privileged GPU process or main browser process. The CPE identifier cpe:2.3:a:mozilla:firefox confirms this affects the desktop Firefox browser product specifically, introduced in version 142.0's WebGPU IPC refactoring and persisting through 144.0.1.
RemediationAI
Immediately upgrade to Firefox 144.0.2 or later, released January 2025, which contains the complete fix for this use-after-free vulnerability. Mozilla's rapid release cycle delivered this patch within two version increments of the vulnerable 142.0 introduction, minimizing exposure window. Organizations should deploy Firefox 144.0.2 through standard software update mechanisms, with Firefox's built-in auto-update feature providing automatic remediation for most consumer installations. Enterprise deployments using managed update frameworks (SCCM, Jamf, Intune) should prioritize this update in patch cycles. No effective workarounds exist short of disabling WebGPU functionality entirely via about:config (dom.webgpu.enabled = false), which breaks legitimate WebGPU applications and is not recommended. Verify successful patching by navigating to about:support and confirming version number shows 144.0.2 or higher. Detailed security advisory and patch notes available at https://www.mozilla.org/security/advisories/mfsa2025-86/ with technical analysis in https://bugzilla.mozilla.org/show_bug.cgi?id=1993113.
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today