CVE-2026-12303: Firefox & Thunderbird WebGPU Information Disclosure

Technical summary

CVE-2026-12303 is an information disclosure vulnerability rooted in incorrect boundary conditions within the Graphics: WebGPU component of Mozilla Firefox and Thunderbird. The flaw is classified under CWE-125 (Out-of-bounds Read) and allows an unauthenticated network attacker to read memory outside intended boundaries without user privileges. Successful exploitation requires user interaction (clicking a link or viewing malicious content) and impacts only confidentiality; integrity and availability are not compromised. The CVSS v3.1 base score of 4.3 reflects the limited attack vector and requirement for user interaction, despite the network accessibility.

Business impact

For organizations relying on Firefox or Thunderbird, this vulnerability poses a targeted data exfiltration risk if users visit compromised or attacker-controlled websites. The exposure is limited to what can be read from adjacent memory regions, which may contain cached credentials, session tokens, or other sensitive data depending on memory layout at the time of exploitation. End-user systems are the primary target; server deployments of these browsers are uncommon, limiting enterprise-wide blast radius. However, high-value users (executives, developers, security staff) are attractive targets for spear-phishing campaigns that deliver malicious pages.

Affected systems

Mozilla Firefox versions prior to 152 and Mozilla Thunderbird versions prior to 152 are affected. Any system running these applications with WebGPU enabled (the default configuration) is vulnerable. Platforms include Windows, macOS, and Linux across all supported versions. Thunderbird users should note that email clients are less likely to encounter malicious content than web browsers, reducing practical exposure.

Exploitability

Exploitability is moderate. An attacker must craft a malicious webpage that triggers the WebGPU boundary condition and convince a user to visit it—via phishing, watering-hole attacks, or ad networks. The vulnerability is not a zero-click exploit and does not grant code execution or persistence. The attack success depends on memory layout randomization (ASLR) and what sensitive data happens to be adjacent in memory; this introduces uncertainty for attackers, making reliable exploitation more difficult than deterministic vulnerabilities. Public exploit code has not been reported as of the advisory date.

Remediation

Update Firefox to version 152 or later and Thunderbird to version 152 or later. Mozilla has released patches addressing the boundary condition issue. Users unable to update immediately should disable JavaScript in their browser settings or avoid visiting untrusted websites until patching is complete, though this degrades functionality. For organizations with managed deployments, use group policy or Mobile Device Management (MDM) to enforce automatic updates or restrict browser access to trusted internal sites only.

Patch guidance

Apply Firefox 152+ and Thunderbird 152+ as soon as feasible within your change management process. Prioritize patching for high-risk user roles (research, C-suite, security teams) and sensitive workstations first. Automated update mechanisms are enabled by default in both applications; verify they are functioning and not blocked by corporate proxies or firewalls. Verify successful patch deployment by checking Help > About in Firefox or About Thunderbird, which will display the installed version.

Detection guidance

Monitor for WebGPU activity and memory access anomalies using browser-based telemetry or EDR tools capable of tracking GPU API calls. Web Application Firewalls (WAFs) may detect suspicious JavaScript patterns associated with WebGPU exploits, though this detection is not yet widely standardized. Network-level detection is limited; focus on endpoint monitoring. Threat hunting should examine browser history and cache for indicators of compromise following suspicious user reports of data exfiltration.

Why prioritize this

Although the CVSS score is MEDIUM (4.3), this vulnerability warrants relatively swift remediation due to its silent nature (no crash or obvious artifacts), the prevalence of Firefox and Thunderbird in office environments, and the potential for targeted spear-phishing campaigns. The requirement for user interaction and memory layout dependencies lower the overall attack likelihood compared to network-accessible code execution flaws, but the confidentiality impact justifies treating it as higher priority than the score alone suggests.

Risk score, explained

The CVSS v3.1 score of 4.3 (MEDIUM) reflects the following factors: Network Attack Vector (AV:N) acknowledges the vulnerability can be triggered over the internet; Low Attack Complexity (AC:L) indicates no special conditions are required; No Privileges Required (PR:N) shows unauthenticated exploitation is possible; Required User Interaction (UI:R) is the primary limiting factor, reducing exploitability in fully automated attack scenarios; Scope Unchanged (S:U) restricts impact to the affected component only; Low Confidentiality Impact (C:L) indicates partial information disclosure rather than complete exposure. Integrity and Availability impact are None (I:N, A:N). The score appropriately reflects a bounded but real information leakage risk without system compromise.

Frequently asked questions