---
id: "CVE-2026-124920"
page: "https://infrastack.ai/live/CVE-2026-124920"
kind: "vulnerability"
aliases: ["CVE-2026-124920"]
title: "Firefox: uninitialized memory in WebGPU graphics lets attackers read or corrupt data"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["desktop-browser", "firefox", "other", "webgpu"]
not_affected_if: ["firefox-160-or-later"]
published_at: "2026-11-10T14:17:25+00:00"
first_seen_at: "2026-11-10T14:22:18+00:00"
updated_at: "2026-11-10T14:24:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124920", "first_seen_at": "2026-11-10T14:22:18+00:00"}]
exploit_sources: []
---

# Firefox: uninitialized memory in WebGPU graphics lets attackers read or corrupt data

Link for people: https://infrastack.ai/live/CVE-2026-124920 (this .md is for agents)

Firefox's WebGPU graphics component reads memory that was never initialized, which can expose or corrupt data the browser holds. The sources do not say whether this leads to code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Firefox version with Help > About Firefox, or `firefox --version` on the command line
- Confirm the installed version is below `160`

## Fix

- Firefox: move to `160` or later, per the sources

## Timeline

- 2026-11-10T14:22:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124920

## From the sources

Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_