CVE-2025-13021

The WebGPU component is responsible for handling graphics and GPU hardware acceleration in the browser. Due to improperly defined boundary conditions (CWE-703 — improper handling of exceptions or error conditions), specially crafted graphic content may trigger unexpected behavior during data processing by the WebGPU engine. An attacker can deliver malicious content over the network without requiring authentication or interaction from the victim, making this vulnerability particularly dangerous.

Successful exploitation of the vulnerability may allow an attacker to execute code remotely (RCE) in the context of the browser process, and consequently gain full control over the attacked system — compromising its confidentiality, integrity, and availability.

Mozilla Firefox browser should be updated immediately to version 145 or later, and Mozilla Thunderbird mail client should be updated to version 145 or later. Patches are available through official Mozilla distribution channels.

Mozilla Firefox in versions prior to Firefox 145 and Mozilla Thunderbird in versions prior to Thunderbird 145.