CVE-2025-13026 is a vulnerability in Mozilla Firefox's Graphics: WebGPU component where incorrect boundary conditions lead to a sandbox escape. This vulnerability was reported by Jamie Nicol and is tracked under Bug 1994441. It was addressed and fixed in Firefox 145 and Thunderbird 145. The CVSS v3.1 score is 9.8 (critical), indicating network attack vector, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. The issue is part of a broader set of memory safety bugs fixed in these releases.

Successful exploitation of this vulnerability could allow an attacker to escape the sandbox environment in Firefox, potentially leading to arbitrary code execution with the privileges of the user running the browser. This results in a critical impact on confidentiality, integrity, and availability of the affected system. However, no known exploits in the wild have been reported at this time.

This vulnerability has been fixed in Mozilla Firefox 145 and Thunderbird 145. Users and administrators should update to these versions or later to remediate the issue. The vendor advisory explicitly states the fix is available and incorporated in these releases. No additional mitigation steps are required beyond applying the official update.