CVE-2025-12380

Critical · CVSS 9.8

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: other; CWE-416

Description

Starting with Firefox 142, it was possible for a compromised child process to trigger a use-after-free in the GPU or browser process using WebGPU-related IPC calls. This may have been usable to escape the child process sandbox. This vulnerability was fixed in Firefox 144.0.2.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1993113
https://www.mozilla.org/security/advisories/mfsa2025-86/

Status: profiled · ingested 2026-09-30T18:00:02.000Z