CVE-2025-13023

The vulnerability results from incorrectly defined boundary conditions in the WebGPU handling component in the Firefox graphics layer. The sandbox mechanism is designed to isolate browser processes from the operating system, however, incorrect boundary verification allows it to be bypassed. An attacker can provide specially crafted WebGPU content that will compromise the isolation logic and escape the sandbox. Due to the network vector (AV:N) and lack of requirements for authentication or user interaction (PR:N, UI:N), the attack can be conducted remotely.

Successful exploitation of the vulnerability allows an attacker to escape the browser sandbox, which may lead to gaining full control over the victim's system – including confidentiality, integrity, and availability of data (CVSS C:H/I:H/A:H).

Mozilla Firefox should be updated to version 145 or later, and Mozilla Thunderbird to version 145 or later. Patches are available directly from the vendor according to published security advisories MFSA2025-87 and MFSA2025-90.

Mozilla Firefox in versions prior to 145 and Mozilla Thunderbird in versions prior to 145.