Mozilla Firefox CVE-2026-84123

User interaction is required - the victim must actively visit an attacker-controlled webpage (UI:R in CVSS). No authentication or existing session is needed from the attacker's side (PR:N). WebGPU processing must be active, which is the default in modern Firefox installations; no non-default configuration change is required to be vulnerable. Exploitation is limited by the need for social engineering or malvertising delivery; automated scanning and mass exploitation are not feasible (SSVC Automatable: no). The scope is contained to the browser process (S:U), so a full OS-level sandbox escape is not confirmed by available data.

The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a high-severity network-exploitable flaw requiring no authentication but demanding one user interaction - the victim must visit a malicious page. SSVC reinforces this: Technical Impact is rated 'total' (consistent with H/H/H CIA), but Automatable is 'no' (driven by UI:R) and Exploitation status is 'none,' indicating no observed in-the-wild use. No CISA KEV listing and no public POC further support treating this as a high-priority patch rather than an emergency incident response. The S:U (scope unchanged) metric suggests exploitation is contained to the browser process and does not represent a confirmed full sandbox escape, which moderates the real-world blast radius. The primary limiting factor is the UI:R requirement, which prevents automated mass exploitation - phishing or malvertising delivery is the realistic threat model.

An attacker hosts a webpage containing maliciously crafted WebGPU shader or resource sequences designed to trigger a use-after-free in Firefox's graphics component. When a victim is lured to the page via phishing or malvertising, the freed memory is accessed or overwritten during WebGPU processing, corrupting heap state and allowing the attacker to redirect execution flow within the browser process, escalating privileges and gaining full read/write/execution control of the browser context.