CVE-2026-12293: Mozilla Firefox WebGPU Use-After-Free Code Execution

HERMES

HERMES THREAT SCORE & WEBGPU EXPLOITATION POTENTIAL

Target: Mozilla Firefox WebGPU Subsystem (wgpu / Buffer Management)

Confidence: 98%

92 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 19 / 20

Threat Activity 17 / 20

Weaponization 19 / 20

Exposure 18 / 20

Prevalence 20 / 20

Impact 20 / 20

Exploit Maturity 18 / 20

Attack Chain Potential 19 / 20

⚖️ Divergence & Operational Rationale

Hermes assesses CVE-2026-12293 at Critical severity (HTS 92). WebGPU provides direct, low-level access to graphics hardware memory buffers from JavaScript. Heap corruption within the WebGPU driver enables reliable heap spraying and arbitrary code execution.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-12293: Mozilla Firefox WebGPU Use-After-Free Code ExecutionVULNERABILITY

Connected Nodes: 0

Critical WebGPU Use-After-Free

CVSS v3.1: 9.0 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) / CWE-416: Use After Free.
Disclosed by Mozilla. A memory lifecycle management vulnerability in the WebGPU API allows web content to access deallocated GPU buffer descriptors, causing memory corruption and arbitrary code execution in the browser process. Fixed in Firefox 152 and Firefox ESR 140.12.

---

1. Metadata & Attack Surface

Metric	Technical Specification	Operational Impact
CVE Identifier	CVE-2026-12293	Standardized vulnerability identifier
Affected Subsystem	Graphics: WebGPU	Next-gen web graphics compute API
Fixed Releases	Firefox 152, Firefox ESR 140.12	Official security release
Associated CWE	CWE-416: Use After Free	Heap memory corruption & code execution

---

2. Remediation & Hardening

1. Apply Browser Upgrade: Upgrade to Firefox 152 or Firefox ESR 140.12.
2. Disable WebGPU in High-Security Profiles: Configure dom.webgpu.enabled = false in about:config or through enterprise policy.