External risk intelligence

WebGPU Boundary Condition Vulnerability in Thunderbird and Firefox

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-100763

The vulnerability resides in a web browser component (WebGPU) that requires a user to navigate to a malicious site or interact with content. It is a client-side attack surface, not a public-facing service, gateway, or internet-accessible appliance that is reachable independent of specific user-initiated browsing activity.

Memory Corruption

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in the Graphics: WebGPU component of certain Mozilla products. This issue allows for potential system compromise due to improper handling of data boundaries. While the main concern is confirming relevance and exposure, understanding this type of flaw helps maintain a robust security posture.

Flaw in graphics component can be exploited remotely.
It affects web browsers and requires user interaction.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by tricking a user into visiting a malicious website. This would expose the vulnerable Graphics: WebGPU component, potentially leading to unauthorized access to sensitive information and system compromise.

No privileges needed to start.
Triggered by visiting a malicious website.
Leads to data theft and system compromise.

Live Threat

Current exploitation, exposure, and threat context

Incorrect boundary conditions in the Graphics: WebGPU component could allow an unauthenticated attacker to gain read access to system memory or cause a denial of service when supported by the advisory. This may impact the confidentiality and availability of the affected system.

System memory confidentiality.
Via crafted web content.
Potential for information disclosure.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for maintaining and updating the browser software, likely including platform or infrastructure teams, should take the lead. The first practical step is to identify all instances of the affected browser across the environment, confirm their reachability and business criticality, and then assign ownership for remediation based on the risk assessment.

Browser owners should manage the issue.
Verify browser reachability and business criticality.
Plan remediation and coordinate updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WebGPU component in Firefox and Thunderbird?

WebGPU is a modern web standard integrated into these browsers that provides hardware-accelerated graphics and compute capabilities. It allows web applications to perform intensive tasks directly on the computer's graphics processing unit (GPU), enabling advanced features like complex 3D rendering and machine learning within the browser environment.

What does CVE-2026-100763 mean by incorrect boundary conditions?

This refers to a memory safety weakness, specifically classified as CWE-119. It occurs when the software fails to properly check the limits of memory buffers while processing graphics data. Because the component does not verify these boundaries, an attacker can cause the program to read data outside of intended areas or crash the application, leading to memory disclosure or system instability.

How is this WebGPU vulnerability triggered?

The flaw is triggered when a user navigates to a malicious website containing specially crafted content that interacts with the vulnerable WebGPU component. It is important to note that simply having the browser installed does not trigger the bug; the vulnerability is not reachable unless the user actively visits and interacts with a compromised or malicious web page.

Is my system at risk if I use these browsers internally?

According to Halo Surface Signal, this is a client-side vulnerability, not a public-facing service or server-side appliance. While it can be reached over the network, it requires user-initiated browsing activity to manifest. Your risk level depends on your organization's browsing habits and the likelihood of users navigating to untrusted or malicious content, rather than the browser's connectivity status.

Do I need to update my software to fix this?

Yes. The most effective step is to ensure that all instances of Firefox and Thunderbird are updated to version 157 or later. You should start by inventorying your environment to identify where these browsers are running, confirming their usage, and coordinating a standardized update process to ensure all clients receive the necessary security patches.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.