CVE-2025-13021 is a critical vulnerability involving incorrect boundary conditions in the Graphics: WebGPU component of Mozilla Firefox. This memory safety bug could result in memory corruption, potentially allowing an attacker to execute arbitrary code. The issue affects Firefox 144 and earlier versions but was addressed in Firefox 145. The vulnerability is tracked under Mozilla Foundation Security Advisory MFSA2025-87 and MFSA2025-90, which confirm the fix and provide references to related bugs. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

The vulnerability can lead to severe memory corruption in Firefox's WebGPU graphics component, potentially allowing remote attackers to execute arbitrary code without requiring user interaction or privileges. This poses a critical risk to confidentiality, integrity, and availability of affected systems. However, no active exploitation has been reported. The flaw also affects Thunderbird in browser-like contexts, but not through email reading due to scripting restrictions.

Mozilla has released an official fix for this vulnerability in Firefox 145 and Thunderbird 145. Users and administrators should update to these versions or later to remediate the issue. Since the vulnerability is fixed in these releases, no additional mitigation steps are required beyond applying the official update. Patch status is confirmed by Mozilla advisories MFSA2025-87 and MFSA2025-90.