{"id":"CVE-2026-124920","kind":"vulnerability","aliases":["CVE-2026-124920"],"related":[],"title":"Firefox: uninitialized memory in WebGPU graphics lets attackers read or corrupt data","description":"Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160.","summary":"Firefox's WebGPU graphics component reads memory that was never initialized, which can expose or corrupt data the browser holds. The sources do not say whether this leads to code execution.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-browser","firefox","other","webgpu"],"not_affected_if":["firefox-160-or-later"],"how_to_check":"- Check the Firefox version with Help > About Firefox, or `firefox --version` on the command line\n- Confirm the installed version is below `160`","fix":"- Firefox: move to `160` or later, per the sources","status":"open","published_at":"2026-11-10T14:17:25+00:00","first_seen_at":"2026-11-10T14:22:18+00:00","triaged_at":"2026-11-10T14:24:30+00:00","updated_at":"2026-11-10T14:24:30+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T14:24:30Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox: move to `160` or later, per the sources","reach":"unknown","title":"Firefox: uninitialized memory in WebGPU graphics lets attackers read or corrupt data","impact":"medium","summary":"Firefox's WebGPU graphics component reads memory that was never initialized, which can expose or corrupt data the browser holds. The sources do not say whether this leads to code execution.","audience":"everyone","category":"other","nicknames":[],"who_cares":["firefox","webgpu","desktop-browser"],"confidence":0.4,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown; memory disclosure or corruption in the browser process","analyst_note":"Check the Mozilla security advisory for this CVE to confirm the impact, whether WebGPU is on by default, and the trigger conditions.","how_to_check":"- Check the Firefox version with Help > About Firefox, or `firefox --version` on the command line\n- Confirm the installed version is below `160`","plain_action":"Update Firefox to version 160 or later: open the menu, choose Help, then About Firefox.","product_name":"","needs_analyst":true,"not_affected_if":["firefox-160-or-later"],"who_is_affected":"Anyone running Firefox older than version 160 with WebGPU in use, which is typically a browser that loads pages using GPU graphics. Systems that cannot run Firefox or do not use WebGPU are unlikely to be affected. The sources do not say whether WebGPU is enabled by default.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000726,"input_tokens":4469,"output_tokens":559,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124920':15A,18A '-2026':14A,17A '160':69C 'attack':8A 'browser':21B,43B 'code':54B 'compon':29B,62C 'corrupt':11A,40B 'cve':13A,16A 'data':12A,41B 'desktop':20B 'desktop-brows':19B 'execut':55B 'expos':38B 'firefox':1A,22B,25B,68C 'fix':66C 'graphic':6A,28B,60C 'hold':44B 'initi':35B 'lead':52B 'let':7A 'memori':3A,31B,57C 'never':34B 'read':9A,30B 'say':49B 'sourc':46B 'uniniti':2A,56C 'vulner':64C 'webgpu':5A,24B,27B,61C 'whether':50B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox older than version 160 with WebGPU in use, which is typically a browser that loads pages using GPU graphics. Systems that cannot run Firefox or do not use WebGPU are unlikely to be affected. The sources do not say whether WebGPU is enabled by default.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox to version 160 or later: open the menu, choose Help, then About Firefox.","pkeys":[],"ptokens":[],"labels":["desktopbrowser","firefox","other","unknown","webgpu"],"campaign_type":null,"search_a":"'-124920':15A,18A '-2026':14A,17A 'attack':8A 'corrupt':11A 'cve':13A,16A 'data':12A 'firefox':1A 'graphic':6A 'let':7A 'memori':3A 'read':9A 'uniniti':2A 'webgpu':5A","search_b":"'browser':21B,43B 'code':54B 'compon':29B 'corrupt':40B 'data':41B 'desktop':20B 'desktop-brows':19B 'execut':55B 'expos':38B 'firefox':22B,25B 'graphic':28B 'hold':44B 'initi':35B 'lead':52B 'memori':31B 'never':34B 'read':30B 'say':49B 'sourc':46B 'webgpu':24B,27B 'whether':50B","search_c":"'160':69C 'compon':62C 'firefox':68C 'fix':66C 'graphic':60C 'memori':57C 'uniniti':56C 'vulner':64C 'webgpu':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124920","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124920","severity":null,"published_at":"2026-11-10T14:17:25+00:00","modified_at":"2026-11-10T14:17:25+00:00","first_seen_at":"2026-11-10T14:22:18+00:00","fetched_at":"2026-11-10T14:22:18+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}