CVE-2025-13023 is a sandbox escape vulnerability in Mozilla Firefox's Graphics: WebGPU component due to incorrect boundary conditions. This vulnerability was identified and reported by Oskar L and is classified under CWE-703. It was fixed in Firefox 145 and Thunderbird 145 as part of a broader set of memory safety bugs affecting Firefox 144 and Thunderbird 144. The vulnerability has a CVSS v3.1 base score of 9.8 (critical), indicating it is remotely exploitable without user interaction and can lead to complete confidentiality, integrity, and availability compromise. The Mozilla advisories mfsa2025-87 and mfsa2025-90 provide detailed information and confirm the fix status.

The vulnerability allows an attacker to escape the browser sandbox, potentially leading to arbitrary code execution with the privileges of the user running Firefox or Thunderbird. This can result in full compromise of the affected system. The CVSS score of 9.8 reflects the high severity and critical impact of this flaw. Although no known exploits in the wild have been reported, the presence of memory corruption evidence suggests significant risk if exploited.

Mozilla has released official fixes for this vulnerability in Firefox 145 and Thunderbird 145. Users and administrators should update to these versions or later to remediate the issue. Since this is not a cloud service, remediation depends on applying these updates. Patch status is confirmed by Mozilla advisories mfsa2025-87 and mfsa2025-90. No additional mitigation actions are required beyond applying the official updates.