Mozilla Firefox CVE-2026-100802

Requires the victim to use the WebGPU feature path in Firefox before version 157 and to visit an attacker-controlled page containing crafted WebGPU content (UI:R - user interaction is mandatory). WebGPU is enabled in modern Firefox but exercising the bug depends on GPU-backed rendering/compute being available and active. Exploitation is limited to an availability impact (process crash/instability per the C:N/I:N/A:L vector); no authentication is required (PR:N) but no code execution or data disclosure is indicated by the vendor scoring.

This is a genuinely low-priority issue despite being a memory-safety class bug. The Mozilla-assigned CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, base 4.3) scores confidentiality and integrity as None with only Low availability impact - i.e., a browser tab/process crash, not the RCE outcome of the use-after-free siblings in the same Firefox 157 batch (MFSA2026-97). There is a notable tension worth flagging: CWE-457 (uninitialized memory) combined with the 'Information Disclosure' tag would normally imply a confidentiality impact (C:L), yet Mozilla scored C:N/I:N and only A:L, indicating the uninitialized data is not observed to leak to the attacker but manifests as instability. VERIFY whether any information-disclosure path exists - the tag and vendor vector conflict. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active or imminent exploitation. Exploitation also requires user interaction (UI:R - the victim must load a crafted WebGPU page). Net: a real but minor availability bug, correctly rated ~Medium/Low CVSS, not a security priority beyond routine patching.

An attacker hosts a web page containing crafted WebGPU (GPU shader/compute) content and lures a Firefox user (pre-157) to visit it. The page triggers use of uninitialized memory in the Graphics: WebGPU component, causing a crash or unstable behavior in the affected process. No public exploit code was identified, and the vendor vector indicates only an availability (denial-of-service) outcome rather than code execution or data theft.