An incorrect boundary check in the Graphics: WebGPU component allows a sandbox escape, enabling an attacker to execute arbitrary code outside the browser or email client sandbox. The flaw maps to control‑flow alteration and buffer over‑read weaknesses, consistent with CWE‑703 and CWE‑787, and can be leveraged to compromise confidentiality, integrity, and availability of the host system.

Mozilla products affected are Firefox and Thunderbird running versions earlier than 145. Users with these browsers should review their installation and update to the latest releases, which contain the fix.

With a CVSS score of 9.8 the vulnerability is considered critical, yet the EPSS score of below 1% indicates that exploitation is currently unlikely. It is not listed in CISA KEV, so no proven exploitation is reported, but a hostile webpage that makes use of WebGPU could trigger the sandbox escape if the affected product is used. Based on the description, it is inferred that a malicious web page could potentially trigger the sandbox escape, though the official advisory does not explicitly confirm this attack vector.