Description
Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
Published: 2026-07-21
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw originates from uninitialized memory usage in the Graphics: WebGPU component API calls. The documented weakness is classified as CWE-908 and CWE-824 and carries a CVSS score of 7.5, indicating a substantial risk to confidentiality if exploited.

Affected Systems

Mozilla Firefox and Mozilla Thunderbird running versions prior to 153 are affected. Users on these older releases may be exposed until they upgrade to the patched versions.

Risk and Exploitability

Although the CVSS score signals a high severity, the EPSS score of less than 1% indicates a low exploitation probability. The vulnerability is not listed in CISA's KEV catalog. The attack vector would presumably involve a web page or extension that enables WebGPU, requiring the ability to run additional graphics code; this is typically available to any site that can execute JavaScript.

Generated by OpenCVE AI on August 3, 2026 at 00:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Mozilla Firefox to version 153 or newer and upgrade Thunderbird to version 153 or newer.
  • Disable WebGPU by setting the preference privacy.features.webgpu.enabled to false to block the feature until a patch is applied.
  • Monitor web pages that use WebGPU for unexpected memory disclosures and alert administrators if leakage is detected.

Generated by OpenCVE AI on August 3, 2026 at 00:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-824
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 22 Jul 2026 20:00:00 +0000

Type Values Removed Values Added
Description Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153. Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
References

Wed, 22 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-908
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 02:45:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 21 Jul 2026 12:45:00 +0000

Type Values Removed Values Added
Description Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153.
Title Information disclosure due to uninitialized memory in the Graphics: WebGPU component
References

Subscriptions

Mozilla Firefox Thunderbird
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-07-22T19:18:47.737Z

Reserved: 2026-07-20T21:56:57.902Z

Link: CVE-2026-16384

cve-icon Vulnrichment

Updated: 2026-07-22T17:12:56.616Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-21T13:17:13.560

Modified: 2026-07-27T13:49:27.663

Link: CVE-2026-16384

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-21T12:37:58Z

Links: CVE-2026-16384 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T01:00:04Z

Weaknesses
  • CWE-824

    Access of Uninitialized Pointer

  • CWE-908

    Use of Uninitialized Resource