CVE-2026-12293: WebGPU Use-After-Free in Firefox, Thunderbird

CVE-2026-12293 is a critical use-after-free (CVSS 9.8 in the CVE record) in the Graphics: WebGPU component of Mozilla Firefox and Thunderbird. It is fixed in Firefox 152 and Thunderbird 152, announced on 16 June 2026. Update, restart the application and check managed machines.

What's affected

From the CVE record and the Mozilla advisories:

• Products: Mozilla Firefox and Mozilla Thunderbird.
• Fixed in: Firefox 152 and Thunderbird 152, per MFSA 2026-57 and MFSA 2026-60.
• Component: Graphics: WebGPU.
• Mozilla impact rating: high. Both advisories were announced on 16 June 2026 and fix many other flaws in the same release.
• Weakness classes: CWE-416 (use after free) and CWE-825 (expired pointer dereference).
• Other versions: the record names only version 152 as the fix. If you run an extended support release or a distribution package, read the advisory for your release line, because the advisories we read list 152 only.
• Thunderbird note: Mozilla says that, in general, such flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but they are potential risks in browser or browser-like contexts.

How to check if you're exposed

1. In Firefox, open the menu, choose Help, then About Firefox. The version and update status appear in the window. In Thunderbird, use Help and About Thunderbird.
2. From a command line on Linux or macOS:

firefox --version
thunderbird --version

3. On managed fleets, query your software inventory or endpoint management tool for Firefox and Thunderbird versions, and list every machine below 152.
4. Remember that an update takes effect only after a restart. A long running browser session can stay on the old code for days.
5. If you install from a Linux distribution, check your distribution's security tracker. Red Hat, for example, tracks this CVE on its own security page.

What to do now

1. Update Firefox and Thunderbird to version 152 or later on every machine, then restart them.
2. Force the restart on managed devices, or message users, because a downloaded update does not protect an open session.
3. For distribution packages, install the distribution's update and confirm the package version.
4. Check embedded or kiosk systems that run a pinned Firefox build, since they are easy to miss.
5. Keep automatic updates on. The same release fixed a long list of other high impact flaws, so the update is worth taking even if you judge this CVE alone to be low risk for you.

Why it matters

A use-after-free happens when a program keeps using memory after it has been released. If the memory has been reused for something else in the meantime, the program may read or write data it should not, and in the worst case an attacker can steer execution. Browsers are common targets because they run code from the web at large scale.

WebGPU is the interface that lets web pages use the graphics processor. It is complex, it sits between untrusted page code and the graphics stack, and memory handling bugs in that kind of code are a recurring class of browser flaw. Mozilla rates the impact as high, and the CVE record gives 9.8. The CVE is not in the CISA Known Exploited Vulnerabilities catalog, and neither advisory says it is exploited.

The practical lesson is about update discipline. Browser flaws like this are fixed in a routine release, and the risk window is the time between the release and the restart on each machine. Watching for new advisories and tracking versions across a fleet closes that window.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Gold entry and CVE record: CVE-2026-12293.
• Mozilla Foundation Security Advisory 2026-57, Firefox 152, announced 16 June 2026.
• Mozilla Foundation Security Advisory 2026-60, Thunderbird 152, announced 16 June 2026.

Last reviewed: 19 October 2026.