This vulnerability is a use-after-free flaw in the WebGPU component of Mozilla’s rendering engine. The flaw can cause memory corruption when the component accesses freed memory, potentially enabling execution of arbitrary code. The weakness is represented by CWE-416 (Use After Free).

The flaw affects Mozilla’s products Firefox and Thunderbird on all versions released prior to version 152. Those customers should verify that their installations are at least at version 152 or later.

The EPSS score is below 1%, indicating a very low probability of immediate exploitation, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is a maliciously crafted web page that is rendered in a browser or mail client using WebGPU; once the client processes the page, the use-after-free can be triggered. The CVSS score of 9.8 indicates critical severity. Because the flaw resides in a low-level graphics component, successful exploitation requires the attacker to have access to the user’s machine, either through a privileged user or by luring the user to visit the malicious content.