CVE-2026-5733
Published: 07 April 2026
Summary
CVE-2026-5733 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Mozilla Firefox. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 13.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Mandates timely identification, reporting, and correction of flaws such as this WebGPU buffer overflow by applying vendor patches like Firefox 149.0.2.
Implements memory safeguards like DEP and ASLR to prevent unauthorized code execution from buffer overflow exploits in the WebGPU component.
Requires validation of information inputs to the WebGPU interface to restrict operations within proper memory bounds and mitigate boundary condition errors.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables remote code execution in the browser rendering process via a crafted webpage exploiting WebGPU, directly facilitating drive-by compromise through user-visited malicious content (T1189) and exploitation of client application vulnerabilities for code execution (T1203).
NVD Description
Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 149.0.2 and Thunderbird 149.0.2.
Deeper analysisAI
CVE-2026-5733 is a vulnerability involving incorrect boundary conditions in the Graphics: WebGPU component of Mozilla Firefox and Thunderbird. Classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), it was assigned a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and published on 2026-04-07. The issue was addressed in Firefox version 149.0.2 and Thunderbird version 149.0.2.
A remote attacker can exploit this vulnerability by tricking a user into interacting with malicious content, such as visiting a crafted webpage that leverages the WebGPU interface. No privileges are required on the part of the attacker, and the attack has low complexity. Successful exploitation enables high-impact consequences, including unauthorized access to sensitive data (C:H), modification of system integrity (I:H), and disruption of availability (A:H), potentially leading to arbitrary code execution within the browser's rendering process.
Mozilla's security advisories (MFSA2026-25 and MFSA2026-28) and the associated Bugzilla entry (bug 2022554) detail the patch deployment in Firefox 149.0.2 and Thunderbird 149.0.2. Security practitioners should ensure users update to these versions or later to mitigate the risk, as no workarounds are specified in the provided references.
Details
- CWE(s)