Mozilla Firefox EUVD-2026-88916

Requires the victim to load attacker-controlled web content that exercises the Graphics: WebGPU component (UI:R), so exploitation depends on user interaction such as visiting a malicious or compromised page. WebGPU must be reachable/enabled in the victim's Firefox build (it is on by default in modern desktop Firefox). No authentication is required (PR:N) and complexity is low (AC:L), but the flaw is fixed in Firefox 157, so only pre-157 versions are exploitable. Scope is unchanged (S:U): impact is confined to the content process, not the host OS.

This is a mid-to-high priority browser flaw, not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8) describes a network-reachable, unauthenticated, low-complexity memory-corruption bug requiring user interaction (victim must load attacker content), with total impact to the compromised content process. All three exploitation signals argue AGAINST imminent mass exploitation: SSVC gives Exploitation:none (no observed activity), Automatable:no (requires a victim to visit a page, so it cannot be sprayed at scale), and there is no EPSS score, no CISA KEV listing, and no public POC in the provided data. SSVC Technical Impact:total is consistent with the C:H/I:H/A:H memory-corruption class. The one point of tension: the description and 'Privilege Escalation' tag frame this as priv-esc, while CWE-119/'Buffer Overflow' and the S:U (unchanged scope) vector indicate in-process memory corruption rather than a cross-boundary sandbox escape - the 8.8 (not 9.6) score and S:U confirm it stays within the content process, so 'privilege escalation' here is best read as gaining code execution within that process, not host takeover. Net: a real bug worth patching promptly, but current evidence points to no active or automatable exploitation.

An attacker hosts a malicious web page containing crafted WebGPU workloads that trigger an out-of-bounds/incorrect-boundary condition in Firefox's Graphics: WebGPU component. A victim running a vulnerable Firefox (pre-157) visits the page, and the boundary violation corrupts memory in the content process, enabling attacker-controlled code execution within that process. No public exploit code is identified at time of analysis, and exploitation requires user interaction (UI:R).