Mozilla Firefox EUVD-2026-88952

Requires the victim to actively browse to attacker-controlled web content using a vulnerable Firefox build (prior to version 157) with the WebGPU graphics path exercised - hence UI:R (user interaction). No authentication is required (PR:N), and it is remotely reachable over the network (AV:N), but exploitation is gated by user interaction and by the content reaching the WebGPU rendering component. Realistic impact is limited to a crash/denial-of-service (A:L); no code execution, integrity, or confirmed data-disclosure impact per the vendor vector.

This is a genuinely low-priority issue despite affecting a ubiquitous product. Mozilla's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) yields only 4.3, with the sole impact being low availability - i.e., a crash rather than data theft or code execution. There is no EPSS score, no CISA KEV listing, and no public exploit code, so all exploitation signals point to no active or imminent threat. Note a tension: CWE-457 (uninitialized memory) and the 'Information Disclosure' tag both suggest a confidentiality leak, yet Mozilla explicitly scored C:N/I:N/A:L (availability-only), meaning the vendor assessed this as a crash/instability bug, not a memory-disclosure bug. Where a scoring gap exists, defer to Mozilla's own vector since they authored the advisory. Compared to its FF157 sibling advisories (numerous 8.8 use-after-free RCE-class bugs), this is at the very bottom of the batch and should be patched routinely, not urgently.

An attacker hosts a malicious web page containing crafted WebGPU content and lures a Firefox user (pre-157) to visit it. Rendering the page reads uninitialized memory in the Graphics: WebGPU component, most plausibly crashing the tab or browser. No public proof-of-concept exists and impact is limited to availability.