Use-After-Free Vulnerability in Firefox Affecting Mozilla Products
CVE-2025-12380

9.8CRITICAL

Key Information:

Vendor

Mozilla
Status
Firefox
Vendor
CVE Published:
28 October 2025

What is CVE-2025-12380?

A vulnerability has been identified in Firefox starting from version 142, where a compromised child process could exploit a use-after-free condition in the GPU or browser process through WebGPU-related IPC calls. This flaw could potentially allow for circumvention of the child process sandbox, leading to security risks for users. It is crucial for users to upgrade to version 144.0.2 or later to mitigate this vulnerability.

Affected Version(s)

Firefox < 144.0.2

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1993113
https://www.mozilla.org/security/advisories/mfsa2025-86/

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Oskar L
JSON
.
CVE-2025-12380 : Use-After-Free Vulnerability in Firefox Affecting Mozilla Products