CVE-2025-12380: 
Mozilla Firefox vulnerability analysis and mitigation

Starting with Firefox 142, a critical vulnerability (CVE-2025-12380) was discovered that allowed a compromised child process to trigger a use-after-free condition in the GPU or browser process through WebGPU-related IPC calls. The vulnerability affects Firefox versions below 144.0.2 and was disclosed on October 28, 2025 (Mozilla Advisory, NVD).

The vulnerability is classified as a Use-After-Free (CWE-416) weakness with a CVSS v3.1 base score of 9.8 (Critical). The attack vector is network-based, requires low attack complexity, needs no privileges or user interaction, and has an unchanged scope with high impact on confidentiality, integrity, and availability (Ubuntu, NVD).

The vulnerability could potentially allow an attacker to escape the child process sandbox, leading to elevated privileges and compromising the security boundaries of the browser. This could result in high impacts on system confidentiality, integrity, and availability (Mozilla Advisory, AttackerKB).

Mozilla has addressed this vulnerability in Firefox version 144.0.2. Users are strongly advised to update to this version or later to mitigate the risk (Mozilla Advisory, ASEC).