CVE-2026-16385 is an information disclosure vulnerability resulting from uninitialized memory usage in the Graphics: WebGPU component of Mozilla Firefox. This vulnerability allows an attacker to potentially access sensitive information from memory that was not properly initialized before use. The flaw was addressed and fixed in Firefox version 153. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to confidentiality. The vendor advisory from Mozilla confirms the fix and recommends updating to Firefox 153 or later.

Successful exploitation of this vulnerability could lead to unauthorized disclosure of sensitive information from uninitialized memory in the WebGPU graphics component. The impact is limited to confidentiality with no integrity or availability effects. No known exploits are reported in the wild, reducing immediate risk but the high severity score indicates a significant potential impact if exploited.

Mozilla has released an official fix for this vulnerability in Firefox version 153. Users and administrators should update affected Firefox installations to version 153 or later to remediate this issue. No additional mitigation steps are required beyond applying the official update.