CVE-2025-12380
📋 TL;DR
A use-after-free vulnerability in Firefox's WebGPU implementation allows a compromised child process to trigger memory corruption in the GPU or browser process via IPC calls. This could enable sandbox escape from the child process sandbox. Affects Firefox versions 142 through 144.0.1.
💻 Affected Systems
- Mozilla Firefox
📦 What is this software?
Firefox by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via sandbox escape leading to arbitrary code execution with browser process privileges, potentially enabling malware installation, data theft, or lateral movement.
Likely Case
Browser compromise leading to session hijacking, credential theft, or installation of malicious extensions/add-ons.
If Mitigated
Limited to browser compromise without system-level access if sandbox escape fails, but still enables data exfiltration from browser context.
🎯 Exploit Status
Exploitation requires compromising a child process first, then leveraging the use-after-free for sandbox escape. No public exploit code available at disclosure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 144.0.2
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2025-86/
Restart Required: Yes
Instructions:
1. Open Firefox. 2. Click menu → Help → About Firefox. 3. Firefox will check for updates and prompt to install 144.0.2. 4. Restart Firefox when prompted.
🔧 Temporary Workarounds
Disable WebGPU
allTemporarily disable WebGPU feature to prevent exploitation
about:config
Set dom.webgpu.enabled to false
🧯 If You Can't Patch
- Disable WebGPU via about:config as temporary mitigation
- Restrict browser usage to trusted sites only until patching possible
🔍 How to Verify
Check if Vulnerable:
Check Firefox version: if between 142.0 and 144.0.1 inclusive, system is vulnerable.Check Version:
firefox --versionVerify Fix Applied:
Verify Firefox version is 144.0.2 or higher via About Firefox dialog.📡 Detection & Monitoring
Log Indicators:
- Browser crash reports with WebGPU-related stack traces
- Unexpected child process termination followed by browser process crashes
Network Indicators:
- Unusual WebSocket or IPC traffic from browser processes
- Connections to known malicious domains hosting WebGPU content
SIEM Query:
source="firefox" AND (event_type="crash" AND process="WebGPU") OR (event_type="sandbox_violation" AND component="gpu_process")