Mozilla Firefox CVE-2026-100763

Exploitation requires the victim to use an affected Firefox version (prior to 157) with WebGPU available/enabled, and to load attacker-controlled web content that drives the vulnerable WebGPU graphics path. The practical limiting factor is user interaction: the victim must navigate to or render a malicious page, so despite the vendor's UI:N, real-world attacks depend on luring the user (phishing, malvertising, compromised site). No authentication is required (PR:N) and the attack is remote over the web. WebGPU support/availability per platform and build may further limit the exposed population.

The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H = 9.1) rates this as a network, no-interaction, unauthenticated memory-corruption flaw with high confidentiality and availability impact. However, these signals conflict in a way defenders should weigh: WebGPU is a browser rendering API that only processes attacker content when a victim navigates to or renders a malicious page, so the real-world trigger requires user interaction (UI:R) and the UI:N in the vendor vector appears overstated - this inflates the base score. The exploitation-likelihood signals point the opposite direction from the 9.1: EPSS is only 0.15% (4th percentile), there is no CISA KEV listing, and no public exploit code is identified, indicating no evidence of active or imminent widespread exploitation. CWE-119 (incorrect boundary conditions) in a GPU shader/compute path is a classic memory-safety bug that is non-trivial to weaponize into reliable code execution, especially from the sandboxed content process. Net: this is a legitimately serious client-side memory-corruption issue worth patching promptly as part of the Firefox 157 update, but the raw 9.1 overstates immediate risk relative to the low EPSS, absent KEV/POC, and the user-interaction requirement inherent to browser rendering bugs.

An attacker hosts a web page containing malicious WebGPU shader or buffer-manipulation content and lures a Firefox user (pre-157) to visit it, e.g. via phishing link or malvertising. The incorrect boundary condition in the WebGPU graphics component triggers an out-of-bounds memory access, potentially leaking process memory (C:H) or crashing the browser (A:H). No public proof-of-concept exploit has been identified at the time of analysis.