CVE-2026-84130 in Firefox
Summary
by MITRE • 09/01/2026
Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/01/2026
The identified vulnerability resides within the Graphics subsystem of Mozilla Firefox, specifically affecting the implementation of the WebGPU API. WebGPU is a modern graphics and compute interface designed to provide efficient access to GPU capabilities for web applications, serving as a successor to WebGL with improved performance and security models. The flaw involves an information disclosure mechanism that allows unauthorized parties to extract sensitive data from the browser's memory or rendering pipeline. This type of vulnerability typically arises when internal state variables, intermediate computation results, or hardware-specific details are inadvertently exposed through side channels, improper error handling, or insufficient isolation between different execution contexts within the graphics stack.
From a technical perspective, this issue likely stems from how the WebGPU implementation manages resource allocation and memory mapping on the client-side GPU driver interface. When an application requests specific graphical resources or performs complex rendering operations, the browser must translate these high-level API calls into low-level commands for the underlying hardware. If there is a lapse in validating input parameters or sanitizing output buffers before they are returned to the JavaScript environment, sensitive information such as memory addresses, cryptographic keys cached in GPU registers, or proprietary data from other tabs can be leaked. This aligns with CWE-200, which classifies Information Exposure vulnerabilities where security-sensitive information is disclosed without proper access controls. The flaw represents a failure in enforcing strict boundaries between the web content and the privileged browser processes that handle graphics rendering.
The operational impact of this vulnerability is significant for users relying on Firefox to process sensitive graphical data or perform computations involving confidential inputs. Attackers could potentially exploit this weakness through malicious websites designed to probe the WebGPU implementation, extracting information that aids in further attacks such as cross-site scripting persistence or cryptographic key recovery. In environments where WebGL or WebGPU are used for secure visualization of proprietary designs, financial models, or medical imaging data, an information leak can lead to intellectual property theft or compliance violations with regulations like GDPR or HIPAA. The severity is compounded by the fact that graphics processing units often cache large amounts of temporary data, increasing the potential blast radius if isolation mechanisms fail.
Mitigation strategies primarily involve applying the software updates provided by Mozilla, which have addressed this flaw in Firefox version 155 and Firefox Extended Support Release (ESR) version 153.2. These patches likely include stricter input validation for WebGPU API calls, enhanced memory sanitization routines, and improved isolation between web content and graphics drivers. Administrators should ensure that all endpoints running affected versions of Firefox are updated immediately to close this attack vector. Additionally, organizations can implement Content Security Policy directives to restrict the use of experimental or high-risk APIs where not strictly necessary, thereby reducing the surface area for exploitation. Monitoring browser telemetry for unusual GPU resource usage patterns may also help in detecting potential attempts to exploit such vulnerabilities before they result in significant data loss.