Uninitialized memory exists in the Graphics: WebGPU component of Mozilla products. This is a CWE-457 weakness, allowing an attacker to corrupt or read arbitrary memory locations when WebGPU content is processed. Although the vulnerability does not guarantee code execution, memory corruption could lead to data exposure or unintended behavior.

Mozilla Firefox and Firefox ESR versions prior to ESR 153.4 and standard releases prior to 157, as well as Thunderbird releases prior to Thunderbird 157 (or Thunderbird 153.4 for the ESR branch) are affected. Any build lacking the specific patch that addresses the uninitialized memory in the WebGPU component remains vulnerable. Upgrading to Firefox ESR 153.4, Firefox 157, Thunderbird 157, or any later release resolves the issue.

The CVSS score of 4.3 indicates a moderate severity. Because the flaw resides in a component that can be invoked by a web page, a remote attacker might trigger the memory corruption with malicious content, potentially leading to unintended behavior, data compromise, or code execution. The EPSS score is less than 1 %, indicating a very low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, so there is no public evidence of active exploitation. Risk remains moderate until further information becomes available.