This vulnerability in Firefox for macOS arises from improper handling of WebGL shader attributes, leading to an out-of-bounds read condition (CWE-125). This memory corruption flaw could be leveraged in combination with other vulnerabilities to escalate privileges. The vulnerability is specific to Firefox on macOS; other Firefox versions and platforms are unaffected. Mozilla fixed this issue in Firefox 138 and Firefox ESR 128.10, as well as corresponding Thunderbird versions. The CVSS v3.1 score is 5.9 (medium severity), reflecting network attack vector with high impact on confidentiality but requiring high attack complexity and no user interaction.

The vulnerability allows an out-of-bounds read in WebGL shader attributes on Firefox for macOS, which by itself does not directly lead to privilege escalation or code execution. However, when chained with other vulnerabilities, it could enable an attacker to escalate privileges. There are no known exploits in the wild. The impact is limited to confidentiality breaches and potential privilege escalation on affected versions of Firefox for macOS.

This vulnerability has been fixed in Firefox 138, Firefox ESR 128.10, Thunderbird 138, and Thunderbird 128.10. Users and administrators should update affected Firefox for macOS installations to these versions or later to remediate the issue. Other versions and platforms are not affected. No additional mitigation actions are required beyond applying the official updates.