This vulnerability arises from incorrect boundary checks in the Graphics: WebGPU component, which allows a malicious actor to escape the sandbox and write beyond intended memory limits. The exploitation can compromise the confidentiality, integrity, and availability of the host system, potentially enabling full control over the affected application and, by extension, the underlying operating system. The weakness is characterized by CWE‑787 (Out‑of‑Bounds Write) and CWE‑703 (Incorrect Resource Usage).

Mozilla Firefox and Thunderbird versions released before 145 are affected. The fix was applied in Firefox 145 and Thunderbird 145, so any instance running a prior release is vulnerable. The issue is not vendor‑specific beyond these products and does not affect other Mozilla applications.

The CVSS score of 9.8 indicates a critical severity level. The EPSS score of less than 1% suggests a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to involve malicious WebGPU code executed in a web page or mail message, which could be delivered locally or remotely depending on the user’s browsing or email habits. If such code runs, the sandbox escape can allow arbitrary code execution with the same privileges as the application. The risk remains high until the vulnerability is mitigated.