CVE-2026-5733 involves incorrect boundary conditions in the Graphics: WebGPU component of Mozilla Firefox, leading to memory safety issues classified under CWE-119 and CWE-787. The vulnerability was resolved in Firefox 149.0.2 and Thunderbird 149.0.2. The Mozilla security advisories MFSA2026-25 and MFSA2026-28 detail this and related memory safety bugs, noting that some showed evidence of memory corruption with potential for arbitrary code execution if exploited. The vulnerability has a CVSS 3.1 base score of 8.8 (high severity), with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. No known exploits have been observed in the wild. The vendor advisory explicitly states the vulnerability is fixed in Firefox 149.0.2.

Successful exploitation of this vulnerability could lead to arbitrary code execution due to memory corruption in the WebGPU graphics component. The CVSS score of 8.8 indicates a high impact on confidentiality, integrity, and availability. However, no known exploits in the wild have been reported to date.

A fix is available and has been officially released by Mozilla in Firefox version 149.0.2 and Thunderbird 149.0.2. Users and administrators should update affected products to these versions or later to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.