CVE-2025-12380: Mozilla Firefox Use-After-Free Flaw

CVE-2025-12380 Overview

CVE-2025-12380 is a use-after-free vulnerability in Mozilla Firefox affecting WebGPU-related inter-process communication (IPC). A compromised child process can trigger memory corruption in the GPU or browser process by issuing crafted WebGPU IPC calls. Successful exploitation may allow an attacker to escape the Firefox content sandbox and execute code in a higher-privileged process context. The flaw was introduced in Firefox 142 and remediated in Firefox 144.0.2. Mozilla tracks this issue under advisory MFSA-2025-86 and bug 1993113. The vulnerability is classified under [CWE-416: Use After Free].

Critical Impact
A compromised renderer can escape the Firefox sandbox by corrupting memory in the GPU or parent browser process through WebGPU IPC, enabling code execution outside the constrained child process.

Affected Products

Mozilla Firefox 142
Mozilla Firefox 143
Mozilla Firefox versions prior to 144.0.2

Discovery Timeline

2025-10-28 - CVE-2025-12380 published to NVD
2026-04-13 - Last updated in NVD database

Technical Details for CVE-2025-12380

Vulnerability Analysis

Firefox uses a multi-process architecture where untrusted web content runs in sandboxed child processes that communicate with the privileged parent (browser) process and the GPU process via IPC channels. WebGPU is a low-level graphics API that exposes GPU functionality to web content and requires extensive IPC between the content process and the GPU process for resource and command management.

The vulnerability stems from improper object lifetime management on the GPU or browser side of WebGPU IPC handling. A child process under attacker control can craft IPC message sequences that reference an object after it has been freed, producing a use-after-free condition in privileged process memory.

Root Cause

The defect is a use-after-free in WebGPU IPC handlers in the GPU and browser processes. Code paths exposed in Firefox 142 release a backing object while a reference remains reachable from another IPC handler, allowing subsequent operations to dereference freed memory. The condition is tracked as [CWE-416].

Attack Vector

Exploitation requires a pre-existing compromise of a Firefox content child process, typically achieved through a separate renderer vulnerability triggered by a malicious page. Once the child process is controlled, the attacker issues malformed WebGPU IPC calls to the GPU or browser process to manipulate object lifetimes. Successful corruption of freed memory in the privileged process can be converted into arbitrary code execution, breaking out of the content sandbox.

No public proof-of-concept code is available. Refer to the Mozilla Security Advisory MFSA-2025-86 and Mozilla Bug Report #1993113 for vendor-supplied technical detail.

Detection Methods for CVE-2025-12380

Indicators of Compromise

Firefox GPU process (firefox.exe --type=gpu-process or equivalent on macOS/Linux) crashing repeatedly with access violations or heap corruption signatures.
Unexpected child processes spawned by the Firefox parent or GPU process following navigation to untrusted sites.
Crash reports referencing WebGPU IPC handlers, WebGPUParent, or wgpu modules in the call stack.

Detection Strategies

Inventory installed Firefox versions across the fleet and flag any installation below 144.0.2.
Monitor process creation telemetry for anomalous child processes parented to firefox or its GPU subprocess.
Correlate Firefox crash dumps with subsequent suspicious activity such as outbound C2 connections or credential access from the browser user context.

Monitoring Recommendations

Forward endpoint process and crash telemetry to a centralized analytics platform and alert on Firefox GPU process exceptions paired with code execution events.
Track WebGPU usage in enterprise environments via browser policy reporting where WebGPU is not required for business workflows.
Review EDR behavioral alerts for sandbox-escape patterns originating from browser child processes.

How to Mitigate CVE-2025-12380

Immediate Actions Required

Upgrade all Firefox installations to version 144.0.2 or later without delay.
Validate enterprise deployments (Firefox ESR, managed installs) and push updates through configuration management tooling.
Restart Firefox after patching to ensure the vulnerable processes are no longer running in memory.

Patch Information

Mozilla fixed CVE-2025-12380 in Firefox 144.0.2. The fix is documented in Mozilla Security Advisory MFSA-2025-86 with implementation details in Mozilla Bug Report #1993113. Apply the vendor update; no supported configuration change replaces the patch.

Workarounds

Disable WebGPU via the dom.webgpu.enabled preference in about:config until patching is complete on all endpoints.
Restrict browsing to trusted sites and block known-malicious domains at the network egress layer to reduce the chance of a chained renderer compromise.
Enforce least-privilege user accounts so that any post-exploitation activity following a sandbox escape is contained.

bash

# Disable WebGPU enterprise-wide via Firefox policies.json
# Place at: <Firefox install>/distribution/policies.json (Windows)
#          /etc/firefox/policies/policies.json (Linux)
#          /Applications/Firefox.app/Contents/Resources/distribution/policies.json (macOS)
{
  "policies": {
    "Preferences": {
      "dom.webgpu.enabled": {
        "Value": false,
        "Status": "locked"
      }
    }
  }
}