While the two vulnerabilities are both related to memory usage and control, they are in two different components. CVE-2022-26485 is a flaw in the XLST (Extensible Stylesheet Language Transformation) component. This component is used to convert XML into a readable web page or PDF. By removing a parameter for XSLT during processing an attacker could leave the browser in an exploitable state due to the way memory is handled.
On the other hand, CVE-2022-26486 is related to the WebGPU IPC (inter-process communication) framework. WebGPU has been touted as the logical successor to the current WebGL library. In this case the attacker can insert an unexpected message to create the same exploitable situation as well as allowing a sandbox escape.
Memory handling flaws are a popular target in browsers and other software as they are not overly complicated to attack. In the few we have seen in 2022 there is no real heavy lift on the part of the attacker to get the flaw in play. This makes them attractive targets as they can have a high payoff for not a lot of effort. If you are using Firefox or Thunderbird, you should update these now to ensure you are not open to attack.
Happy Patching.
