The vulnerability arises from improper handling of boundary conditions within the Graphics: WebGPU component, creating an opportunity for memory corruption. The issue is classified as a buffer overflow and an out‑of‑bounds write, allowing an attacker who can introduce malicious WebGPU instructions to overwrite critical memory and potentially execute arbitrary code. The impact is severe, threatening the confidentiality, integrity, and availability of the affected system.

The flaw affects Mozilla Firefox and Mozilla Thunderbird browsers running versions prior to 149.0.2. Any user running a vulnerable build of these applications is potentially exposed until they upgrade to the fixed releases.

With a CVSS score of 8.8, the vulnerability is considered high severity. The EPSS score of less than 1% indicates a low expected exploitation probability, and it is not yet listed in CISA’s KEV catalog. Based on the nature of the flaw and its location in a web‑based graphics API, the attack vector is inferred to be remote, most likely through a malicious webpage or email that triggers the WebGPU component.