CVE-2025-13026

The WebGPU component in Firefox improperly checks boundary conditions when processing graphics operations. The error classified as CWE-703 indicates improper handling of exceptional or abnormal states, which leads to violation of sandbox environment isolation. An attacker can exploit this vulnerability over the network, without the need to have privileges or engage user actions.

Successful exploitation of the vulnerability allows an attacker to escape from the isolated sandbox environment of the browser, which may lead to taking control of the system — complete violation of confidentiality, integrity and availability of data.

Mozilla Firefox should be updated to version 145 or later and Mozilla Thunderbird to version 145 or later. Patches were released by the vendor according to the references: mfsa2025-87 (Firefox) and mfsa2025-90 (Thunderbird).

Mozilla Firefox in versions prior to 145 and Mozilla Thunderbird in versions prior to 145.