External risk intelligence

Firefox WebGPU Sandbox Escape Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-12380

The vulnerability exists within the browser's internal process architecture (child process to GPU/browser process IPC). It is a client-side browser component issue requiring local execution, not a network-facing service, gateway, or internet-exposed endpoint.

Use After Free

Mozilla Firefox

142.0 to before 144.0.2

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in certain versions of Firefox, allowing a compromised child process to potentially escape its sandbox, impacting the GPU or browser process. This issue could have significant implications for system security if exploited.

A process could break out of its sandbox.
Matters for system security and data integrity.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability if they can trick a user into visiting a malicious website. This would cause a compromised child process within the browser to send specific messages to the GPU or browser process. If successful, this could allow the attacker to break out of the browser's security sandbox, potentially leading to broader system compromise.

Requires a malicious website visit.
Triggered by WebGPU-related inter-process calls.
Allows sandbox escape for potential system compromise.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in Firefox's WebGPU-related inter-process communication could allow a compromised child process to escape its sandbox, potentially impacting the GPU or browser process when supported by the advisory.

Child process sandbox escape.
Compromised child process triggers vulnerability.
Potential compromise of GPU or browser process.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-World Ownership

Teams responsible for managing end-user application deployments and web browser configurations will likely own this vulnerability. This includes desktop support, endpoint management, or application packaging teams. The first practical step is to identify all instances of the affected browser, confirm if they are user-facing or critical, and then plan remediation activities during scheduled maintenance windows.

Browser and endpoint owners
Confirm browser version and reachability.
Plan controlled updates during maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Firefox and how does it manage browser processes?

Firefox is a web browser developed by Mozilla that uses a multi-process architecture to improve stability and security. It separates the main browser process from child processes that handle individual web pages or specific tasks like graphics rendering via WebGPU. This design is intended to contain web content within a sandbox, preventing it from directly accessing the operating system or other sensitive areas of the computer.

What is a use-after-free vulnerability in CVE-2025-12380?

A use-after-free (CWE-416) occurs when software continues to use a memory address after it has been cleared or released. In the context of CVE-2025-12380, the browser's WebGPU component incorrectly manages this memory during inter-process communication. An attacker can manipulate this flaw to potentially run unauthorized code, effectively breaking the rules that keep the browser's processes separated.

How is this Firefox sandbox escape triggered?

The vulnerability is triggered when a user visits a malicious website that forces a compromised child process to send specific, malformed messages to the GPU or browser process. If you are not browsing the web or if the browser does not process these specific WebGPU-related instructions, the conditions for this bug do not exist. It requires active interaction with web content to initiate the faulty communication path.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates this vulnerability is unlikely to be triggered remotely like a network service. Because the flaw exists within the internal process architecture of the browser, it requires local execution rather than being a gateway or internet-exposed endpoint. While it requires a user to visit a malicious site, the risk is centered on the browser's internal security boundaries rather than direct network-level exposure.

How should I respond to this Firefox vulnerability?

The primary response is to ensure your Firefox installations are updated to version 144.0.2 or later, which contains the fix for this issue. You should identify all systems running Firefox in your environment, prioritize machines that browse the internet, and schedule these updates as part of your standard maintenance. Coordinating with your endpoint management or IT support teams is the best way to handle this deployment efficiently.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.