Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2022-26486

An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.

CVSS 9.6 · CriticalBuzz score 55.3KEV listed

Buzz score

Why this CVE is surfacing

Buzz score total 55.3

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 20.8 · diversity 9.5 · KEV 25.0 · OTX 0.0 · PoC 0.0
Mention score
20.8
7 evidence mentions in the snapshot
Diversity score
9.5
4 sources across 1 categories
KEV score
25.0
Known exploited vulnerability present
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
7 source links · newest first
  • Week in review: Linux bug gives root access to attackers, UPS devices’ vulns, IoT security for OEMsHelp Net Security

    Here’s an overview of some of last week’s most interesting news, articles and interviews: Mozilla fixes Firefox zero-days exploited in the wild (CVE-2022-26485, CVE-2022-26486) Mozilla has released an out-of-band security update for Firefox, Firefox Focus, and Thunderbird, fixing two critical vulnerabilities (CVE-2022-26485, CVE-2022-26486) exploited by attackers in the wild. Easily exploitable Linux bug gives root access to attackers (CVE-2022-0847) An easily exploitable vulnerability (CVE-2022-0847) in the Linux kernel can be used by local unprivileged users … More →

    newswww.helpnetsecurity.comMar 13, 2022, 9:00 AM
  • CISA urges to fix actively exploited Firefox zero-days by March 21Security Affairs

    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added recently disclosed Firefox zero-days to its Known Exploited Vulnerabilities Catalog. The Cybersecurity and Infrastructure Security Agency (CISA) added two critical security vulnerabilities in Mozilla firefox, tracked as CVE-2022-26485 and CVE-2022-26486, to its Known Exploited Vulnerabilities Catalog. The US agency has ordered federal civilian agencies to address both issues by […]

    newssecurityaffairs.comMar 8, 2022, 4:07 PM
  • CISA Urges Organizations to Patch Recent Firefox Zero-DaysSecurityWeek

    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday announced the inclusion of 11 security holes in its Known Exploited Vulnerabilities Catalog.

    newswww.securityweek.comMar 8, 2022, 1:42 PM
  • Emergency Firefox Update Patches Two Actively Exploited Zero-Day VulnerabilitiesSecurityWeek

    Mozilla over the weekend issued an emergency security update for Firefox to address two zero-day vulnerabilities that have been exploited in attacks.

    newswww.securityweek.comMar 7, 2022, 11:35 AM
  • Mozilla fixes Firefox zero-days exploited in the wild (CVE-2022-26485, CVE-2022-26486)Help Net Security

    Mozilla has released an out-of-band security update for Firefox, Firefox Focus, and Thunderbird, fixing two critical vulnerabilities (CVE-2022-26485, CVE-2022-26486) exploited by attackers in the wild. About the vulnerabilities (CVE-2022-26485, CVE-2022-26486) The two patched zero-days are both memory corruption bugs of the “use-after-free” kind, meaning that they may allow attackers to use memory that has been freed by the program. CVE-2022-26485 affects XSLT parameter processing and can be used to achieve remote code execution within the … More →

    newswww.helpnetsecurity.comMar 7, 2022, 10:46 AM
  • Mozilla addresses two actively exploited zero-day flaws in FirefoxSecurity Affairs

    Mozilla fixed two critical actively exploited zero-day bugs in Firefox with the release of 97.0.2, ESR 91.6.1, Firefox for Android 97.3.0, and Focus 97.3.0. Mozilla has released Firefox 97.0.2, Firefox ESR 91.6.1, Firefox for Android 97.3.0, and Focus 97.3.0 to address a couple of critical zero-day vulnerabilities, tracked as CVE-2022-26485 and CVE-2022-26485, actively exploited in […]

    newssecurityaffairs.comMar 7, 2022, 7:35 AM
  • Update now! Mozilla patches two actively exploited vulnerabilitiesMalwarebytes Labs

    Mozilla has announcedit has fixed security vulnerabilities in Firefox 97.0.2, Firefox ESR 91.6.1, Firefox for Android 97.3.0, and Focus 97.3.0. Users…

    newswww.malwarebytes.comMar 6, 2022, 5:00 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence