CVE-2026-12293: Use-after-free in the Graphics: WebGPU component

Synopsis

A use-after-free vulnerability exists in the WebGPU graphics component of Mozilla Firefox and Thunderbird. The flaw is reachable over the network with no authentication required, meaning a malicious web page or email can trigger it without any special access. Successful exploitation gives an attacker full control over the affected process, enabling arbitrary code execution, data theft, and application crashes. A patched-image rebuild at version 152 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable component is exposed over the network, meaning an attacker can reach it by serving a malicious web page or HTML email without requiring any local access to the host.

• AuthenticationNot required

  No account or credentials are needed; any unauthenticated party who can get the browser or mail client to load attacker-controlled content can trigger the vulnerability.

• Victim interactionNot required

  No user action beyond normal browsing or opening a message is required, as the attack does not depend on the victim clicking a specific element or approving a prompt.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special environmental conditions, race windows, or memory-layout requirements on the attacker.

Blast Radius

• An attacker achieves arbitrary code execution inside the Firefox or Thunderbird process, giving full control over that process's execution context.
• All data accessible to the browser or mail client, including stored credentials, session tokens, cookies, and locally cached files, can be read.
• An attacker can write or modify data within the process, including in-memory state that governs application behavior.
• The affected application process can be crashed on demand, causing a denial of service for the end user.