The vulnerability involves a use‑after‑free in the WebGPU component of Mozilla’s graphics subsystem. When WebGPU resources are freed and subsequently accessed, memory corruption can occur, potentially enabling an attacker to execute arbitrary code. This aligns with CWE‑416 and CWE‑825 and can compromise confidentiality or integrity if malicious web content is rendered through WebGPU.

The flaw affects Mozilla Firefox through version 157 and earlier. The fix is incorporated in Firefox 157 onward. All installations of Firefox that have not yet reached or surpassed this version are potentially vulnerable, regardless of operating system. Mozilla Thunderbird is also affected and was fixed in version 157.

The EPSS score of <1% indicates a very low but nonzero exploitation probability; the vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known exploitation at this time. However, the nature of the flaw—use‑after‑free in a web‑enabled graphics component—implies a high severity if exploited, as it could be triggered by a maliciously crafted web page or a compromised resource loaded by WebGPU. The CVSS score of 8.8 indicates high severity. The risk model suggests that an unpatched client could be used to execute arbitrary code with the privileges of the Firefox process. This aligns with CWE‑416 and CWE‑825 and can compromise confidentiality or integrity. The likely attack vector is remote, via WebGPU‑enabled content delivered through a browser session.