PatchTheCVECVE-2022-26486: Mozilla Firefox Use-After-Free Vulnerability
85
Patch now
CRITICAL 9.6EXPLOITEDUPGRADEUPGRADEUPGRADE
CVE-2022-26486 is a critical-severity flaw (CVSS 9.6) affecting firefox, firefox focus, firefox mobile, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
Why this priority
- Critical severity
- Exploited in the wild (CISA KEV)
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.6 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 2.4% (top 16%) |
| CISA exploited list | Yes, fix due 2022-03-21 |
| Weakness | CWE-416 |
| Published | 2022-12-22 |
| Last modified | 2026-08-19 |
Publisher (CNA): Mozilla Corporation · Vendor: mozilla
Last updated 2026-08-19 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Exploited Added to the CISA Known Exploited Vulnerabilities list
- Deadline CISA due date for US federal agencies to patch
- Published CVE record published
- Updated Record last modified
mozilla firefox UPGRADE
Affected: < 91.6.1 · < 97.0.2
Fixed in: 91.6.1, 97.0.2
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy firefox || rpm -q firefox || firefox --version
2. UPGRADE to 91.6.1 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade firefox
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade firefox
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
mozilla firefox focus UPGRADE
Affected: < 97.3.0
Fixed in: 97.3.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy firefox-focus || rpm -q firefox-focus || firefox-focus --version
2. UPGRADE to 97.3.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade firefox-focus
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade firefox-focus
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
mozilla firefox mobile UPGRADE
Affected: < 97.3.0
Fixed in: 97.3.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy firefox-mobile || rpm -q firefox-mobile || firefox-mobile --version
2. UPGRADE to 97.3.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade firefox-mobile
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade firefox-mobile
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
mozilla thunderbird UPGRADE
Affected: < 91.6.2
Fixed in: 91.6.2
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy thunderbird || rpm -q thunderbird || thunderbird --version
2. UPGRADE to 91.6.2 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade thunderbird
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade thunderbird
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
Exact fixes by distribution
Fedora ELN · libslirp · FIXED · 4.9.7-1.eln159 · FEDORA-2026-209cb94e13 · source
sudo dnf upgrade --advisory=FEDORA-2026-209cb94e13
Fedora 46 · modpoll · FIXED · 1.6.1-1.fc46 · FEDORA-2026-60d403ff15 · source
sudo dnf upgrade --advisory=FEDORA-2026-60d403ff15
Debian 12 · firefox-esr · FIXED · 91.6.1esr-1
sudo apt update && sudo apt install --only-upgrade firefox-esr
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' firefox-esr)" ge "91.6.1esr-1" && echo PATCHED || echo STILL-VULNERABLE
Debian 13 · firefox-esr · FIXED · 91.6.1esr-1
sudo apt update && sudo apt install --only-upgrade firefox-esr
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' firefox-esr)" ge "91.6.1esr-1" && echo PATCHED || echo STILL-VULNERABLE
Debian 12 · thunderbird · FIXED · 1:91.6.2-1
sudo apt update && sudo apt install --only-upgrade thunderbird
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' thunderbird)" ge "1:91.6.2-1" && echo PATCHED || echo STILL-VULNERABLE
Debian 13 · thunderbird · FIXED · 1:91.6.2-1
sudo apt update && sudo apt install --only-upgrade thunderbird
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' thunderbird)" ge "1:91.6.2-1" && echo PATCHED || echo STILL-VULNERABLE
RHEL 7 · firefox · FIXED · firefox-91.7.0-3.el7_9
sudo dnf upgrade --advisory=RHSA-2022:0824
rpm -q firefox
RHEL 7 · thunderbird · FIXED · thunderbird-91.7.0-2.el7_9
sudo dnf upgrade --advisory=RHSA-2022:0850
rpm -q thunderbird
RHEL 8 · firefox · FIXED · firefox-91.7.0-3.el8_5
sudo dnf upgrade --advisory=RHSA-2022:0818
rpm -q firefox
RHEL 8 · thunderbird · FIXED · thunderbird-91.7.0-2.el8_5
sudo dnf upgrade --advisory=RHSA-2022:0845
rpm -q thunderbird
RHEL 8.1 Update Services for SAP Solutions · firefox · FIXED · firefox-91.7.0-3.el8_1
sudo dnf upgrade --advisory=RHSA-2022:0815
rpm -q firefox
Alpine 3.20 · firefox-esr · FIXED · firefox-esr-91.6.1-r0
apk add --upgrade firefox-esr
apk info -v firefox-esr
Alpine 3.20 · firefox · FIXED · firefox-97.0.2-r0
apk add --upgrade firefox
apk info -v firefox
Alpine 3.20 · thunderbird · FIXED · thunderbird-91.6.2-r0
apk add --upgrade thunderbird
apk info -v thunderbird
Alpine 3.21 · firefox-esr · FIXED · firefox-esr-91.6.1-r0
apk add --upgrade firefox-esr
apk info -v firefox-esr
sudo yum update --advisory=ALAS2-2022-1779
Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2022-26486?
firefox: upgrade to 91.6.1, 97.0.2; firefox focus: upgrade to 97.3.0; firefox mobile: upgrade to 97.3.0. Exact commands for each OS are on this page.
Is CVE-2022-26486 being exploited?
Yes. CVE-2022-26486 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.
What does CVE-2022-26486 affect?
CVE-2022-26486 affects firefox, firefox focus, firefox mobile. Severity is critical (CVSS 9.6). An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1
How urgent is CVE-2022-26486?
Priority 85/100. Critical severity; Exploited in the wild (CISA KEV); Public exploit reference
Software pages
Android vulnerabilities · Mozilla Firefox vulnerabilities · Mozilla Thunderbird vulnerabilities
Related CVEs
- CVE-2026-74990 CRITICAL 9.8 UPGRADE UPGRADE Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153
- CVE-2026-74989 CRITICAL 9.8 UPGRADE UPGRADE Internally found bugs present in Firefox 153
- CVE-2026-74988 CRITICAL 9.8 UPGRADE UPGRADE Internally found bugs present in Firefox ESR 153.0 and Firefox 153
- CVE-2026-74987 CRITICAL 9.8 UPGRADE UPGRADE Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153
- CVE-2026-74969 HIGH 8.8 UPGRADE UPGRADE Race condition, use-after-free in the Layout: Text and Fonts component