Mozilla Firefox EUVD-2026-88920

Requires the victim to use a vulnerable Firefox (pre-157) and to actively load attacker-controlled web content that exercises the WebGPU API, so exploitation is gated by user interaction (UI:R) - the target must navigate to or render a malicious page. WebGPU must be reachable/enabled in the victim's build (it is enabled by default in recent desktop Firefox releases). No authentication is needed (PR:N), but the content process sandbox typically limits impact to the browser process unless chained with a sandbox escape. Limiting factors: mandatory user interaction, dependency on WebGPU being active, and no observed in-the-wild or POC exploitation.

This is a genuinely serious client-side browser vulnerability, though not a top-of-queue emergency. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) describes a network-reachable, low-complexity, unauthenticated use-after-free that requires user interaction (visiting a malicious page) and yields full C/I/A impact - the classic profile of a browser memory-corruption bug that can escalate toward code execution within the content process. No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit (POC=NO), so exploitation status is 'no public exploit identified at time of analysis' - meaning the raw 8.8 reflects potential impact, not observed abuse. The main mitigating factors are the mandatory UI:R (the victim must load attacker-controlled WebGPU content) and Firefox's process sandbox, which typically requires a second sandbox-escape bug to convert content-process corruption into full host compromise. Note also a signal conflict: the C:H/I:H/A:H impact profile indicates memory corruption / potential RCE, which sits awkwardly with the 'Information Disclosure' tag applied to this record - treat the impact as corruption-class, not merely info-leak. Bottom line: a real, patch-now-class browser flaw given Firefox's footprint, but absent active-exploitation evidence it is a medium-priority patch rather than a fire-drill.

An attacker hosts a malicious web page containing crafted WebGPU (GPU compute/graphics) content and lures a Firefox user (versions before 157) to visit it via phishing, malvertising, or a compromised site. Rendering the page triggers the use-after-free in the Graphics: WebGPU component, corrupting content-process memory in a way an attacker can potentially shape toward code execution. No public exploit code was identified at time of analysis; exploitation is theoretical but the low attack complexity makes it a realistic target for weaponization.