CVE-2025-13022

The error concerns incorrect boundary condition checking in the WebGPU component responsible for graphics processing. Improper boundary validation can lead to unexpected memory or program logic behavior. An attacker can trigger the vulnerability through crafted graphic content or WebGPU requests delivered remotely, without requiring user authentication or interaction.

An attacker can gain full access to sensitive data, compromise system integrity, and cause application unavailability, corresponding to a high impact rating on confidentiality, integrity, and availability (C:H/I:H/A:H).

Mozilla Firefox should be immediately updated to version 145 or later, and Mozilla Thunderbird to version 145 or later. Details available in Mozilla security bulletins: mfsa2025-87 and mfsa2025-90.

Mozilla Firefox versions before 145 and Mozilla Thunderbird versions before 145.