External risk intelligence

Firefox WebGPU Sandbox Escape Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-13023

This vulnerability affects the WebGPU component within the Firefox browser. As a client-side web browser component, it is not a network-accessible service, gateway, or public-facing server. It requires a user to navigate to a malicious site or execute specific client-side actions, making it effectively local-only and not a typical public-internet-facing attack surface.

Mozilla Firefox

before 145.0

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in the WebGPU component of Firefox, potentially allowing a sandbox escape. This could enable attackers to bypass security boundaries within the browser, impacting user security and data. The main concern is confirming relevance and exposure to this specific browser functionality.

Browser flaw can break security boundaries.
Critical flaw impacts user security and data.
Confirm relevance and exposure to this browser feature.

Attack Path

How an attacker could exploit the issue

An attacker could leverage this vulnerability by tricking a user into visiting a malicious website. This would expose the browser's Graphics: WebGPU component to an issue with how it handles boundary conditions, potentially allowing the attacker to break out of the browser's security sandbox.

No privileges or user interaction needed.
Vulnerable code triggered by visiting a site.
Sandbox escape and system compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Graphics: WebGPU component could allow an attacker to escape the browser's sandbox when supported by the advisory. This could potentially affect the confidentiality, integrity, and availability of the system.

System data and user data may be at risk.
Exploitation could occur via a malicious website.
Sandbox escape may lead to system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Graphics: WebGPU component in Firefox is affected by a sandbox escape vulnerability. Given that this impacts a client-side application, the first practical step is to identify all instances of the affected browser, determine business criticality and user reachability, and then coordinate with Mozilla for the appropriate remediation.

Browser owners should lead remediation efforts.
Verify user exposure and business criticality.
Plan coordinated updates with Mozilla.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WebGPU component in Firefox?

WebGPU is a modern web standard built into the Firefox browser that allows websites to use your computer's graphics hardware for high-performance calculations and rendering. It helps power complex 3D graphics, advanced data visualizations, and machine learning tasks directly within the browser tab, enabling applications to run much faster than they would using traditional web technologies.

What does sandbox escape mean for CVE-2025-13023?

A sandbox is a security feature that keeps browser processes isolated from the rest of your operating system. CVE-2025-13023 involves an incorrect boundary condition, which is a flaw under the CWE-703 weakness class. This error allows malicious code to break out of that isolated environment, potentially gaining unauthorized access to system resources or user data that the browser is normally restricted from reaching.

How is this WebGPU vulnerability triggered?

This vulnerability is triggered when a browser navigates to a specifically crafted malicious website that interacts with the WebGPU component. It does not require special administrative privileges or complex preconditions. Simply visiting a page that exploits these faulty boundary conditions is sufficient. Note that the issue is specific to the WebGPU implementation; standard web browsing tasks that do not utilize WebGPU functions do not trigger this specific flaw.

Is my computer at risk from this CVE?

Halo Surface Signal classifies this as very unlikely to be an immediate network-based threat because the browser is a client-side application, not a public-facing server. However, you should care if you use an outdated version of Firefox, as the primary risk comes from a user navigating to a malicious site. Because it acts locally, standard network firewalls cannot block the exploit, making the software version on your device the critical factor.

What should I do to secure my system?

The most effective way to address this issue is to update your browser software to version 145 or later. Mozilla released this update specifically to correct the boundary conditions in the WebGPU component. If you manage multiple machines, prioritize identifying systems running older versions of Firefox and schedule an update to the patched release to ensure your security sandbox is properly reinforced against this vulnerability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.