Uninitialized memory in the Graphics: WebGPU component causes the browser to potentially read or write arbitrary memory locations. When an attacker can supply or manipulate data processed by WebGPU, the memory corruption may lead to arbitrary code execution or leakage of sensitive information. The vulnerability is a classic instance of improper initialization, a weakness that can exploit if a malicious web page can invoke the affected code path.

The issue is present in Mozilla Firefox and Firefox ESR before the release of version 153.4 for the ESR line and before version 157 for the standard release. All earlier ESR and non‑ESR builds that lack the specific patch are impacted; upgrading to Firefox ESR 153.4, Firefox 157, or any later version resolves the defect.

No CVSS score is provided and the EPSS score is unavailable, so the quantified risk remains unknown. Because the flaw resides in a component exploitable by a web page, a remote attacker might trigger the memory corruption through malicious content, leading to code execution or data compromise. The vulnerability is not listed in the CISA KEV catalog, so there is no public evidence of active exploitation. Given the nature of the defect, the risk could be considered moderate to high until the permanence and prevalence of exploitation are better understood.