CVE-2026-16376: Firefox WebGPU DoS Vulnerability

CVE-2026-16376 Overview

CVE-2026-16376 is a denial-of-service vulnerability in the Graphics: WebGPU component of Mozilla Firefox and Thunderbird. The flaw allows a remote attacker to exhaust browser resources through a crafted web page, causing the application to become unresponsive or crash. Mozilla addressed the issue in Firefox 153 and Thunderbird 153. The Common Weakness Enumeration classifies this vulnerability as [CWE-400] Uncontrolled Resource Consumption. Exploitation requires no authentication and no user interaction beyond visiting a malicious page.

Critical Impact
A remote, unauthenticated attacker can trigger an availability outage in Firefox or Thunderbird by delivering crafted WebGPU content, disrupting browsing sessions and email workflows.

Affected Products

Mozilla Firefox versions prior to 153
Mozilla Thunderbird versions prior to 153
Graphics: WebGPU component

Discovery Timeline

2026-07-21 - CVE-2026-16376 published to the National Vulnerability Database
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-16376

Vulnerability Analysis

The vulnerability resides in the WebGPU implementation within the Gecko graphics stack shared by Firefox and Thunderbird. WebGPU exposes GPU functionality to web content through JavaScript APIs. When processing certain WebGPU workloads, the component fails to constrain resource consumption, leading to uncontrolled use of memory or GPU processing capacity. The result is a denial-of-service condition affecting the browser or mail client process. The issue is network-reachable because malicious WebGPU content can be delivered through any rendered web page, including HTML email in Thunderbird.

Root Cause

The root cause is uncontrolled resource consumption ([CWE-400]) within the WebGPU pipeline. The component does not enforce sufficient limits on requested GPU resources or command submissions originating from untrusted script. Malformed or excessive workloads propagate into the graphics subsystem without adequate validation or throttling. Mozilla's advisories MFSA-2026-68 and MFSA-2026-71 document the fix as part of the Firefox 153 and Thunderbird 153 release cycle.

Attack Vector

Exploitation occurs over the network. An attacker hosts a page that invokes WebGPU APIs with parameters designed to exhaust resources. When a victim visits the page in Firefox, or when Thunderbird renders remote content referencing the payload, the process hangs or crashes. No credentials and no user interaction beyond page load are required. Confidentiality and integrity are not affected; availability is the sole impact.

No public proof-of-concept code or verified exploit samples are available for this issue. See the Mozilla Bug Report #2035733 for further technical background.

Detection Methods for CVE-2026-16376

Indicators of Compromise

Repeated unexpected crashes or hangs of firefox.exe, firefox, or thunderbird processes correlated with WebGPU usage
Crash reports in about:crashes referencing WebGPU, wgpu, or graphics submission functions
Sudden spikes in GPU memory or GPU process CPU utilization tied to a single browser tab

Detection Strategies

Inventory endpoints running Firefox or Thunderbird below version 153 using software asset management data
Correlate browser crash telemetry with network connections to recently visited domains to identify potential trigger pages
Monitor web proxy logs for pages loading WebGPU shaders from low-reputation domains

Monitoring Recommendations

Ingest browser and mail client crash telemetry into the SIEM and alert on abnormal crash rates per host
Track GPU process resource usage baselines and alert on sustained anomalies
Review Thunderbird remote content settings and flag environments where remote content is enabled by default

How to Mitigate CVE-2026-16376

Immediate Actions Required

Upgrade Firefox to version 153 or later on all managed endpoints
Upgrade Thunderbird to version 153 or later on all workstations that render mail
Prioritize systems used by executives, developers, and other high-value users who browse untrusted content
Validate patch deployment through software inventory reporting after rollout

Patch Information

Mozilla released fixes in Firefox 153 and Thunderbird 153. Refer to Mozilla Security Advisory MFSA-2026-68 and Mozilla Security Advisory MFSA-2026-71 for release details and download links. Enterprise administrators should deploy through existing update channels such as Mozilla's Enterprise Policy Engine, WSUS relays, or endpoint management tooling.

Workarounds

Disable WebGPU where patching is delayed by setting dom.webgpu.enabled to false in about:config
Configure Thunderbird to block remote content in messages to reduce exposure through email rendering
Restrict access to untrusted websites through web filtering until patches are applied

bash

# Disable WebGPU via Firefox enterprise policy (policies.json)
{
  "policies": {
    "Preferences": {
      "dom.webgpu.enabled": {
        "Value": false,
        "Status": "locked"
      }
    }
  }
}