CVE-2026-12293 - Vulnerability Details - OpenCVE

ReportizFlow

Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Mozilla	Firefox

No data.

No data.

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=2039568
https://www.mozilla.org/security/advisories/mfsa2026-57/
https://www.mozilla.org/security/advisories/mfsa2026-60/

History

Thu, 18 Jun 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 18 Jun 2026 04:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Tue, 16 Jun 2026 16:45:00 +0000

Type	Values Removed	Values Added
Description	Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152.	Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.
References		https://www.mozilla.org/security/advisories/mfsa2026-60/

Tue, 16 Jun 2026 15:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla firefox
Vendors & Products		Mozilla Mozilla firefox

Tue, 16 Jun 2026 13:15:00 +0000

Type	Values Removed	Values Added
Description		Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152.
Title		Use-after-free in the Graphics: WebGPU component
References		https://bugzilla.mozilla.org/show_bug.cgi?id=2039568 https://www.mozilla.org/security/advisories/mfsa2026-57/

MITRE

Status: PUBLISHED

Assigner: mozilla

Published: 2026-06-16T11:52:26.913Z

Updated: 2026-06-18T16:11:19.122Z

Reserved: 2026-06-15T15:08:07.470Z

Link: CVE-2026-12293

Vulnrichment

Updated: 2026-06-18T14:25:55.825Z

NVD

Status : Undergoing Analysis

Published: 2026-06-16T13:16:29.553

Modified: 2026-06-16T17:16:33.200

Link: CVE-2026-12293

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12293", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "state": "PUBLISHED", "assignerShortName": "mozilla", "dateReserved": "2026-06-15T15:08:07.470Z", "datePublished": "2026-06-16T11:52:26.913Z", "dateUpdated": "2026-06-18T16:11:19.122Z"}, "containers": {"cna": {"affected": [{"product": "Firefox", "vendor": "Mozilla", "versions": [{"status": "unaffected", "version": "152", "lessThanOrEqual": "*", "versionType": "rpm"}]}, {"product": "Thunderbird", "vendor": "Mozilla", "versions": [{"status": "unaffected", "version": "152", "lessThanOrEqual": "*", "versionType": "rpm"}]}], "descriptions": [{"lang": "en", "value": "Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152."}]}], "title": "Use-after-free in the Graphics: WebGPU component", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2039568"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-57/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-60/"}], "credits": [{"lang": "en", "value": "superhei"}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2026-06-16T16:08:26.090Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-416", "lang": "en", "description": "CWE-416 Use After Free"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-06-18T14:25:08.429325Z", "id": "CVE-2026-12293", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-18T16:11:19.122Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-12293", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-18T14:25:08.429325Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-18T14:25:55.825Z"}}], "cna": {"title": "Use-after-free in the Graphics: WebGPU component", "credits": [{"lang": "en", "value": "superhei"}], "affected": [{"vendor": "Mozilla", "product": "Firefox", "versions": [{"status": "unaffected", "version": "152", "versionType": "rpm", "lessThanOrEqual": "*"}]}, {"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"status": "unaffected", "version": "152", "versionType": "rpm", "lessThanOrEqual": "*"}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2039568"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-57/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-60/"}], "descriptions": [{"lang": "en", "value": "Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.", "supportingMedia": [{"type": "text/html", "value": "Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.", "base64": false}]}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2026-06-16T16:08:26.090Z"}}}, "cveMetadata": {"cveId": "CVE-2026-12293", "state": "PUBLISHED", "dateUpdated": "2026-06-18T16:11:19.122Z", "dateReserved": "2026-06-15T15:08:07.470Z", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "datePublished": "2026-06-16T11:52:26.913Z", "assignerShortName": "mozilla"}, "dataVersion": "5.2"}