The vulnerability involves an uninitialized memory condition in the Graphics: WebGPU component. Because memory that has not been set can be read, the flaw could expose residual data to an attacker. The vulnerability was fixed in Thunderbird 157 and Firefox 157, and the issue is limited to information disclosure without enabling arbitrary code execution.

All Mozilla Firefox releases before version 157 are affected. Version 157 and later include the fix, so any system running Firefox 156 or earlier is potentially exposed.

The CVSS score is 4.3, indicating moderate severity, and the EPSS score is 0.00212 (less than 1%). The vulnerability is not listed in the CISA KEV catalog. Because WebGPU is accessed from web pages via JavaScript, a likely attack vector is a malicious website that causes the browser to use the uninitialized memory. Local exploitation is unlikely unless the attacker can execute code within the browser process. The risk level remains moderate and does not indicate widespread exploitation currently.