Technical impact
This vulnerability arises from incorrect boundary conditions in the WebGPU component of Mozilla products’ graphics subsystem, constituting a classic buffer overflow (CWE‑119). The flaw could potentially lead to memory corruption, and based on the description, it is inferred that an attacker might be able to execute arbitrary code within the browser or client context. The impact, if realized, would jeopardize confidentiality, integrity, and system stability for users of Thunderbird or Firefox.
Affected Systems
Mozilla Firefox and Thunderbird are affected by this issue. All releases prior to version 157 of either product are vulnerable because the issue has been fixed in version 157; newer releases contain the correction. No specific third‑party products are listed, but any user running an older version of Firefox or Thunderbird on a platform that supports WebGPU is at risk.
Risk and Exploitability
The EPSS score is < 1% and the vulnerability is not listed in CISA's KEV catalog, so the exact likelihood of exploitation is low but non‑zero. However, based on the description, it is inferred that the flaw could lead to remote code execution on either Firefox or Thunderbird, and the exploit path involves a WebGPU context that can be triggered by crafted content, making the potential damage high. There is no publicly documented exploit as of the last advisory, but the lack of mitigation in earlier releases poses a serious risk to users who load untrusted WebGPU content.
