A flaw in the WebGPU implementation of Mozilla’s graphics stack allows an attacker to read data from uninitialized memory. This leak exposes information that should remain confidential and is classified as both CWE‑824 (Use of Uninitialized Variable) and CWE‑908 (Information Exposure Through Improper Sanitization). The vulnerability does not provide a path to execute code or elevate privileges; it strictly compromises data confidentiality.

Mozilla’s Firefox and Thunderbird browsers prior to version 153 contain the vulnerable WebGPU component. Any system running an earlier release is subject to this information‑exposure flaw until the fix is applied or WebGPU functionality is disabled.

The likely attack vector is local, requiring a user to load a malicious web page that uses WebGPU, after which the attacker can read residual data from the component’s memory. The CVSS score of 7.5 indicates a high severity for confidentiality loss, while the EPSS score of less than 1% shows that exploitation is currently unlikely and no active exploits are documented in CISA’s KEV catalog. No remote code execution or broader system compromise is possible, but the leak can reveal sensitive user data.