CVE-2026-84130: Firefox WebGPU Information Disclosure Flaw

CVE-2026-84130 Overview

CVE-2026-84130 is an information disclosure vulnerability in the Graphics: WebGPU component of Mozilla Firefox and Thunderbird. The flaw allows content processed by the WebGPU rendering pipeline to expose data that should remain isolated from web content. Mozilla addressed the issue in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

Critical Impact
An attacker who convinces a user to visit a crafted page can trigger the WebGPU component to leak sensitive graphics memory contents to script running in the browser.

Affected Products

Mozilla Firefox versions prior to 155
Mozilla Firefox ESR versions prior to 153.2
Mozilla Thunderbird versions prior to 155 and prior to 153.2

Discovery Timeline

2026-09-01 - CVE-2026-84130 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-84130

Vulnerability Analysis

The vulnerability resides in the WebGPU implementation used by Firefox and Thunderbird for hardware-accelerated graphics and compute workloads. WebGPU exposes GPU functionality to web content through JavaScript APIs, and improper handling within this pipeline can allow content to observe memory that was not intended to be readable. This class of issue falls under Information Exposure, where residual or adjacent graphics memory becomes accessible to the calling context.

Because Thunderbird renders HTML email through the same Gecko engine, mail clients that process remote content are also within scope. The Mozilla Security Advisory MFSA-2026-82 and related advisories track the fixes across the Firefox and Thunderbird release trains. Additional context is available in Mozilla Bug Report #2057834.

Root Cause

The root cause is improper isolation or initialization within the WebGPU graphics component, causing data intended for other GPU contexts or uninitialized buffers to be readable by web content. Detailed technical particulars are restricted in the Mozilla bug tracker pending broad patch adoption.

Attack Vector

Exploitation requires a user to load an attacker-controlled page in an affected Firefox build or open HTML mail content in an affected Thunderbird build with WebGPU features reachable. The attacker script issues WebGPU API calls crafted to trigger the disclosure and reads the leaked data back through standard rendering or compute output paths.

No verified exploitation code is publicly available. Refer to the vendor advisories for the technical description of the fix.

Detection Methods for CVE-2026-84130

Indicators of Compromise

Firefox or Thunderbird processes at versions below the fixed releases (Firefox 155, Firefox ESR 153.2, Thunderbird 155, Thunderbird 153.2) present in the environment.
Browser telemetry or crash reports referencing the WebGPU subsystem after visits to untrusted origins.
Outbound HTTP or WebSocket traffic from a browser session that transmits unusually structured binary payloads shortly after WebGPU-heavy page loads.

Detection Strategies

Inventory installed Mozilla applications and flag any endpoint running a version older than the patched builds.
Correlate proxy or DNS logs with browsing sessions that render WebGPU content from unclassified or newly registered domains.
Alert on Thunderbird processes fetching remote content from HTML email against organizational policy.

Monitoring Recommendations

Track Mozilla security advisory feeds and integrate MFSA identifiers into vulnerability management workflows.
Monitor endpoint software inventory for drift from the approved Firefox and Thunderbird baseline.
Review browser crash and telemetry data for anomalies attributed to graphics or WebGPU modules.

How to Mitigate CVE-2026-84130

Immediate Actions Required

Update Firefox to version 155 or later and Firefox ESR to 153.2 or later on all managed endpoints.
Update Thunderbird to version 155 or later, or 153.2 or later on the ESR channel.
Enforce the update through enterprise policy so users cannot defer the patch beyond the maintenance window.

Patch Information

Mozilla published fixes in the following releases: Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. Consult MFSA-2026-82, MFSA-2026-85, MFSA-2026-86, and MFSA-2026-88 for the full advisory set.

Workarounds

Disable WebGPU in about:config by setting dom.webgpu.enabled to false until the patched build is deployed.
Block HTML remote content rendering in Thunderbird and require plain-text preview for external senders.
Restrict browsing to trusted origins through web proxy allow-listing where the browser cannot be updated immediately.

bash

# Configuration example: enforce WebGPU disable via Firefox enterprise policy (policies.json)
{
  "policies": {
    "Preferences": {
      "dom.webgpu.enabled": {
        "Value": false,
        "Status": "locked"
      }
    }
  }
}