by Kastro
Paper/Archive/CVE-2025-12380

CVE-2025-12380

Mozilla Firefox — Use-after-free in WebGPU internals triggered from a compromised child process

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
35
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 27.2.272 × 205.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Starting with Firefox 142, it was possible for a compromised child process to trigger a use-after-free in the GPU or browser process using WebGPU-related IPC calls. This may have been usable to escape the child process sandbox. This vulnerability was fixed in Firefox 144.0.2.

Affected

ProductAffectedFixed inSource
Firefoxsee advisory144.0.2CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refbugzilla.mozilla.org/show_bug.cgi?id=1993113refmozilla.org/security/advisories/mfsa2025-86