CVE-2026-5733
published 2026-04-07CVE-2026-5733: Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 149.0.2 and Thunderbird 149.0.2.
PriorityP344high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.30%
22.3th percentile
Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 149.0.2 and Thunderbird 149.0.2.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | < firefox 149.0.2-1 (sid) | firefox 149.0.2-1 (sid) |
| mozilla | firefox | < 149.0.2 | 149.0.2 |
| mozilla | firefox | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
firefox: Incorrect boundary conditions in the Graphics: WebGPU component
vendor_redhat·2026-04-07·CVSS 8.8
CVE-2026-5733 [HIGH] CWE-787 firefox: Incorrect boundary conditions in the Graphics: WebGPU component
firefox: Incorrect boundary conditions in the Graphics: WebGPU component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue:
Incorrect boundary conditions in the Graphics: WebGPU component
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.
Package: firefox (Red Hat Enterprise Linux 10) - Not affected
Package: rhel10/firefox-flatpak (Red Hat Enterprise Linux 10) - Not affected
Package: firefox (Red Hat Enterprise Linux 6) - Not affected
Package: firefox (Red Hat Enterprise Linux 7) - Not affected
Package: firefox (Red Hat Enterprise Linux 8) - Not affected
Package: firefox (Red Hat Enterprise Linux 9) - Not affected
Debian
CVE-2026-5733: firefox - Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerabil...
vendor_debian·2026·CVSS 8.8
CVE-2026-5733 [HIGH] CVE-2026-5733: firefox - Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerabil...
Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability affects Firefox < 149.0.2 and Thunderbird < 149.0.2.
Scope: local
sid: resolved (fixed in 149.0.2-1)
Mozilla
Mozilla Foundation Security Advisory 2026-28: CVE-2026-5733
vendor_mozilla·CVSS 8.8
CVE-2026-5733 [HIGH] Mozilla Foundation Security Advisory 2026-28: CVE-2026-5733
Mozilla Foundation Security Advisory 2026-28
CVE: CVE-2026-5733
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 149.0.2
Mozilla
Mozilla Foundation Security Advisory 2026-25: CVE-2026-5733
vendor_mozilla·CVSS 8.8
CVE-2026-5733 [HIGH] Mozilla Foundation Security Advisory 2026-25: CVE-2026-5733
Mozilla Foundation Security Advisory 2026-25
CVE: CVE-2026-5733
Product: Firefox
Impact: high
Fixed in: Firefox 149.0.2
VulDB
Mozilla Firefox up to 149.0.1 WebGPU memory corruption (WID-SEC-2026-0997)
vuldb·2026-05-02·CVSS 8.8
CVE-2026-5733 [HIGH] Mozilla Firefox up to 149.0.1 WebGPU memory corruption (WID-SEC-2026-0997)
A vulnerability, which was classified as critical, was found in Mozilla Firefox up to 149.0.1. This affects an unknown part of the component WebGPU. Such manipulation leads to memory corruption.
This vulnerability is uniquely identified as CVE-2026-5733. The attack can be launched remotely. No exploit exists.
You should upgrade the affected component.
GHSA
GHSA-qh3h-3qgq-cxv8: Incorrect boundary conditions in the Graphics: WebGPU component
ghsa_unreviewed·2026-04-07
CVE-2026-5733 [HIGH] CWE-119 GHSA-qh3h-3qgq-cxv8: Incorrect boundary conditions in the Graphics: WebGPU component
Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability affects Firefox < 149.0.2.
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-33654 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.9
CVE-2026-33654 [HIGH] CVE-2026-33654 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-33654 :
Homebrew vulnerability analysis and mitigation
nanobot/channels/email.py
Source : NVD
## 8.9
Score
Published March 27, 2026
Severity HIGH
CNA Score 8.9
Affected Technologies
Homebrew
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 40.5
Exploitation Probability (EPSS) 0.2
Affected packages and libraries
nanobot
Sources
NVD
Homebrew Severity CRITICAL No Fix Added at: Apr 10, 2026
## Get a CVE risk assessment
Get a prioritized view of CVEs in your cloud—so you can focus on what's exploitable, not just what's listed.
## Related Homebrew vulnerabilities:
CVE ID
Severity
Score
Technologies
Component name
CISA KEV exploit
Has fix
Published date
CVE-2
Wiz
CVE-2026-34387 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.7
CVE-2026-34387 [MEDIUM] CVE-2026-34387 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-34387 :
Homebrew vulnerability analysis and mitigation
Fleet is open source device management software. Prior to 4.81.1, a command injection vulnerability in Fleet's software installer pipeline allows an attacker to achieve arbitrary code execution as root (macOS/Linux) or SYSTEM (Windows) on managed hosts when an uninstall is triggered for a crafted software package. Version 4.81.1 patches the issue.
Source : NVD
## 5.7
Score
Published March 27, 2026
Severity MEDIUM
CNA Score 5.7
Affected Technologies
Homebrew
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 32.3
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
fleet
Sources
NVD
Homebrew Severity CR
Wiz
CVE-2026-26133 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.1
CVE-2026-26133 [HIGH] CVE-2026-26133 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-26133 :
NixOS vulnerability analysis and mitigation
AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.
Source : NVD
## 7.1
Score
Published March 16, 2026
Severity HIGH
CNA Score 7.1
Affected Technologies
NixOS
Homebrew
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 16.6
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
loop
edge
Sources
NVD
Homebrew Severity HIGH Has Fix Added at: Apr 10, 2026
Nix Severity HIGH Has Fix Added at: Apr 10, 2026
## Get a CVE risk assessment
Get a prioritized view of CVEs in your cloud—so you can focus on what's exploitable, not just what's listed.
## Rel
Wiz
CVE-2026-5732 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.4
CVE-2026-5732 [HIGH] CVE-2026-5732 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-5732 :
NixOS vulnerability analysis and mitigation
Incorrect boundary conditions, integer overflow in the Graphics: Text component. This vulnerability affects Firefox < 149.0.2, Firefox ESR < 140.9.1, Thunderbird < 149.0.2, and Thunderbird < 140.9.1.
Source : NVD
## 8.8
Score
Published April 7, 2026
Severity HIGH
CNA Score 8.8
Affected Technologies
NixOS
Mozilla Firefox
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 11.8
Exploitation Probability (EPSS) N/A
Affected packages and libraries
cpe:2.3:a:mozilla:thunderbird
cpe:2.3:a:mozilla:firefox
Sources
Debian 11, 14 Severity HIGH No Fix Added at: Apr 09, 2026
Debian 12, 13 Severity HIGH Has Fix Added at: Apr 09, 2026
Wiz
CVE-2026-34606 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.4
CVE-2026-34606 [HIGH] CVE-2026-34606 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-34606 :
NixOS vulnerability analysis and mitigation
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. From version 2.27.0 to before version 2.48.0, Frappe LMS was vulnerable to stored XSS. This issue has been patched in version 2.48.0.
Source : NVD
## 6.9
Score
Published April 2, 2026
Severity MEDIUM
CNA Score 6.9
Affected Technologies
NixOS
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 9.2
Exploitation Probability (EPSS) N/A
Affected packages and libraries
learning
Sources
NVD
Nix Severity MEDIUM Has Fix Added at: Apr 10, 2026
## Get a CVE risk assessment
Get a prioritized view of CVEs in your cloud—so you ca
Wiz
CVE-2026-30313 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 9.8
CVE-2026-30313 [CRITICAL] CVE-2026-30313 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-30313 :
Homebrew vulnerability analysis and mitigation
DSAI-Cline's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffective. The system relies on string-based parsing to validate commands; while it intercepts dangerous operators such as ;, &&, ||, |, and command substitution patterns, it fails to account for raw newline characters embedded within the input. An attacker can construct a payload by embedding a literal newline between a whitelisted command and malicious code (e.g., git log malicious_command), forcing DSAI-Cline to misidentify it as a safe operation and automatically approve it. The underlying PowerShell interpreter treats the newline as a command separator, executing
Wiz
CVE-2026-5734 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 9.8
CVE-2026-5734 [CRITICAL] CVE-2026-5734 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-5734 :
NixOS vulnerability analysis and mitigation
Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 149.0.2, Firefox ESR < 140.9.1, Thunderbird < 149.0.2, and Thunderbird < 140.9.1.
Source : NVD
## 9.8
Score
Published April 7, 2026
Severity CRITICAL
CNA Score N/A
Affected Technologies
NixOS
Mozilla Firefox
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 14
Exploitation Probability (EPSS) N/A
Affected packages and
Wiz
CVE-2026-5731 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 9.8
CVE-2026-5731 [CRITICAL] CVE-2026-5731 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-5731 :
Mozilla Firefox vulnerability analysis and mitigation
Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 149.0.2, Firefox ESR < 115.34.1, Firefox ESR < 140.9.1, Thunderbird < 149.0.2, and Thunderbird < 140.9.1.
Source : NVD
## 9.8
Score
Published April 7, 2026
Severity CRITICAL
CNA Score 9.8
Affected Technologies
Mozilla Firefox
Mozilla Thunderbird
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile
Wiz
CVE-2026-34200 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.7
CVE-2026-34200 [HIGH] CVE-2026-34200 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-34200 :
NixOS vulnerability analysis and mitigation
Nhost is an open source Firebase alternative with GraphQL. Prior to version 1.41.0, The Nhost CLI MCP server, when explicitly configured to listen on a network port, applies no inbound authentication and does not enforce strict CORS. This allows a malicious website visited on the same machine to issue cross-origin requests to the MCP server and invoke privileged tools using the developer's locally configured credentials. This vulnerability requires two explicit, non-default configuration steps to be exploitable. The default nhost mcp start configuration is not affected. This issue has been patched in version 1.41.0.
Source : NVD
## 7.7
Score
Published March 31, 2026
Severity HIGH
CNA Score 7.7
Affected Technologies
Wiz
CVE-2018-25225 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.6
CVE-2018-25225 [HIGH] CVE-2018-25225 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2018-25225 :
NixOS vulnerability analysis and mitigation
SIPP 3.3 contains a stack-based buffer overflow vulnerability that allows local unauthenticated attackers to execute arbitrary code by supplying malicious input in the configuration file. Attackers can craft a configuration file with oversized values that overflow a stack buffer, overwriting the return address and executing arbitrary code through return-oriented programming gadgets.
Source : NVD
## 8.6
Score
Published March 28, 2026
Severity HIGH
CNA Score 8.6
Affected Technologies
NixOS
Homebrew
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 8.1
Exploitation Probability (EPSS) N/A
Affected packages and libraries
sip
Wiz
CVE-2026-30285 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 9.8
CVE-2026-30285 [CRITICAL] CVE-2026-30285 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-30285 :
NixOS vulnerability analysis and mitigation
An arbitrary file overwrite vulnerability in Zora: Post, Trade, Earn Crypto v2.60.0 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.
Source : NVD
## 9.8
Score
Published March 31, 2026
Severity CRITICAL
CNA Score 9.8
Affected Technologies
NixOS
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 29.5
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
zora
Sources
NVD
Nix Severity CRITICAL No Fix Added at: Apr 10, 2026
## Get a CVE risk assessment
Get a prioritized view of CVEs in your cloud—so you can focus
Wiz
CVE-2026-5735 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.4
CVE-2026-5735 [HIGH] CVE-2026-5735 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-5735 :
NixOS vulnerability analysis and mitigation
Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 149.0.2 and Thunderbird < 149.0.2.
Source : NVD
## 9.8
Score
Published April 7, 2026
Severity CRITICAL
CNA Score N/A
Affected Technologies
NixOS
Mozilla Firefox
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 12.1
Exploitation Probability (EPSS) N/A
Affected packages and libraries
firefox
thunderbird
Sources
Homebrew Severity CRITICAL Has Fix Added at: Apr
Wiz
CVE-2026-5733 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.4
CVE-2026-5733 [HIGH] CVE-2026-5733 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-5733 :
NixOS vulnerability analysis and mitigation
Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability affects Firefox < 149.0.2 and Thunderbird < 149.0.2.
Source : NVD
## 8.8
Score
Published April 7, 2026
Severity HIGH
CNA Score 8.8
Affected Technologies
NixOS
Mozilla Firefox
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 10.8
Exploitation Probability (EPSS) N/A
Affected packages and libraries
cpe:2.3:a:mozilla:firefox
cpe:2.3:a:mozilla:thunderbird
Sources
Homebrew Severity HIGH Has Fix Added at: Apr 10, 2026
Nix Severity HIGH Has Fix Added at: Apr 10, 2026
Ubuntu 22.04 Severity MEDIUM No Fix Added at: Apr 09, 2026
Linux Severity
Bugzilla
CVE-2026-5733 firefox: Incorrect boundary conditions in the Graphics: WebGPU component
bugzilla·2026-04-07·CVSS 8.8
CVE-2026-5733 [HIGH] CVE-2026-5733 firefox: Incorrect boundary conditions in the Graphics: WebGPU component
CVE-2026-5733 firefox: Incorrect boundary conditions in the Graphics: WebGPU component
Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability affects Firefox < 149.0.2.
https://bugzilla.mozilla.org/show_bug.cgi?id=2022554https://www.mozilla.org/security/advisories/mfsa2026-25/https://www.mozilla.org/security/advisories/mfsa2026-28/https://access.redhat.com/security/cve/CVE-2026-5733https://bugzilla.redhat.com/show_bug.cgi?id=2455902https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5733.json
2026-04-07
Published