CVE-2026-12293 is a use-after-free vulnerability affecting the Graphics: WebGPU component in Mozilla Firefox and Thunderbird. This memory safety bug was present in Firefox versions prior to 152 and Thunderbird versions prior to 152. The vulnerability was fixed in Firefox 152 and Thunderbird 152 as part of a broader security update addressing multiple high-impact memory safety issues. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability could allow an attacker to execute arbitrary code due to memory corruption. Mozilla's official advisories confirm the fix and recommend upgrading to version 152 or later.

The vulnerability allows remote attackers to exploit a use-after-free condition in the WebGPU graphics component, potentially leading to arbitrary code execution with high confidentiality, integrity, and availability impact. This could compromise the affected system if exploited. However, no known exploits in the wild have been reported at this time.

Mozilla has released official fixes for this vulnerability in Firefox 152 and Thunderbird 152. Users and administrators should upgrade to these versions or later to remediate the issue. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without upgrading. Patch status is confirmed as fixed in version 152 for both Firefox and Thunderbird.