CVE-2026-16385: WebGPU Information Disclosure Vulnerability

CVE-2026-16385 Overview

CVE-2026-16385 is an information disclosure vulnerability in the Graphics: WebGPU component of Mozilla Firefox and Thunderbird. The flaw stems from uninitialized memory use [CWE-908], allowing remote attackers to read fragments of process memory through crafted WebGPU workloads. Mozilla fixed the issue in Firefox 153 and Thunderbird 153. The vulnerability is exploitable over the network without authentication or user interaction, making any browsing session against a malicious page a potential exposure vector.

Critical Impact
Remote attackers can leak sensitive data from uninitialized GPU-adjacent memory buffers without user interaction, potentially exposing credentials, tokens, or other in-process secrets.

Affected Products

Mozilla Firefox versions prior to 153
Mozilla Thunderbird versions prior to 153
Graphics: WebGPU component in affected builds

Discovery Timeline

2026-07-21 - CVE-2026-16385 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-16385

Vulnerability Analysis

The vulnerability resides in the WebGPU implementation within Firefox's graphics subsystem. WebGPU (Web Graphics Processing Unit) exposes GPU compute and rendering primitives to web content through JavaScript APIs. The flaw allows uninitialized memory contents to be returned to script-accessible buffers, enabling attackers to observe residual data left behind by prior allocations.

Information disclosure through uninitialized memory is classified under [CWE-908]: Use of Uninitialized Resource. In a browser context, the leaked bytes can include heap contents from the content process, which may hold session tokens, cross-origin data, or address layout information useful for follow-on exploitation.

With an EPSS probability of 0.332% and network attack vector requiring no privileges or interaction, mass exploitation via drive-by web content is technically feasible where users run pre-153 builds.

Root Cause

The root cause is a failure to zero-initialize or fully populate buffers before they are exposed to WebGPU callers. When the WebGPU pipeline returns storage buffers, textures, or readback resources to JavaScript, uninitialized regions retain whatever bytes previously occupied that memory. This violates the browser's process-isolation guarantees.

Attack Vector

An attacker hosts a page containing a WebGPU shader or compute pipeline designed to allocate resources and read them back before writing initialized data. The malicious script exfiltrates the returned bytes to an attacker-controlled endpoint. Because Thunderbird shares the Gecko rendering engine, HTML email with remote content rendering can serve as a delivery vector where WebGPU is enabled.

No public proof-of-concept or exploit code has been published. See the Mozilla Bug Report #2041912 for technical details maintained by the Mozilla security team.

Detection Methods for CVE-2026-16385

Indicators of Compromise

Firefox or Thunderbird processes at versions below 153 loading untrusted web content with WebGPU enabled (dom.webgpu.enabled = true).
Outbound HTTP/HTTPS POST requests from browser processes containing large base64 or hex-encoded blobs shortly after visiting unfamiliar pages.
Web pages requesting navigator.gpu.requestAdapter() from low-reputation domains.

Detection Strategies

Inventory endpoints for Firefox and Thunderbird versions using software asset management or EDR telemetry, flagging any build earlier than 153.
Correlate browser process network egress with the domains hosting WebGPU content to identify anomalous data-heavy uploads from firefox.exe or thunderbird.exe.
Deploy web content filtering or DNS-layer controls that log WebGPU-heavy sites and unusual GPU API usage patterns.

Monitoring Recommendations

Track browser telemetry for WebGPU API activation events on managed endpoints.
Alert on Firefox and Thunderbird binaries below version 153 executing on corporate assets.
Review proxy logs for uploads originating from browser child processes exceeding baseline sizes.

How to Mitigate CVE-2026-16385

Immediate Actions Required

Upgrade Firefox to version 153 or later and Thunderbird to version 153 or later on all managed endpoints.
Push updates through enterprise deployment tooling such as Group Policy, Jamf, or Intune to ensure coverage across user populations.
Verify that automatic updates are enabled and functioning for both applications.

Patch Information

Mozilla addressed the vulnerability in Firefox 153 and Thunderbird 153. Refer to Mozilla Security Advisory MFSA-2026-68 and Mozilla Security Advisory MFSA-2026-71 for advisory details and version-specific fix confirmation.

Workarounds

Disable WebGPU by setting dom.webgpu.enabled to false in about:config on Firefox and the equivalent Thunderbird configuration editor until patching completes.
Restrict WebGPU access via enterprise policy using the Preferences policy in the Firefox policies.json file.
Block access to untrusted sites through web proxy or DNS filtering while remediation is in progress.

bash

# Firefox enterprise policy example: disable WebGPU via policies.json
# Path: <Firefox install dir>/distribution/policies.json
{
  "policies": {
    "Preferences": {
      "dom.webgpu.enabled": {
        "Value": false,
        "Status": "locked"
      }
    }
  }
}