CVE-2025-12380
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-28

Last updated on: 2026-04-13

Assigner: Mozilla Corporation

Description
Starting with Firefox 142, it was possible for a compromised child process to trigger a use-after-free in the GPU or browser process using WebGPU-related IPC calls. This may have been usable to escape the child process sandbox. This vulnerability was fixed in Firefox 144.0.2.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-28
Last Modified
2026-04-13
Generated
2026-06-16
AI Q&A
2025-10-28
EPSS Evaluated
2026-06-15
NVD
CVE-2025-12380
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
mozilla firefox From 142.0 (inc) to 144.0.2 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Impact Analysis

If exploited, this vulnerability could allow an attacker who has compromised a child process in Firefox to escape the sandbox, potentially gaining higher privileges or access to sensitive parts of the system, leading to further exploitation or data compromise.

Mitigation Strategies

Update Firefox to version 144.0.2 or later to fix the use-after-free vulnerability related to WebGPU IPC calls and prevent potential sandbox escape.

Executive Summary

This vulnerability is a use-after-free issue in Firefox versions before 144.0.2, where a compromised child process can exploit WebGPU-related inter-process communication (IPC) calls to trigger memory corruption in the GPU or browser process. This could potentially allow the compromised process to escape its sandbox restrictions.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-12380. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart