CVE-2026-5733: 
NixOS vulnerability analysis and mitigation

CVE-2026-5733 is a memory buffer boundary condition vulnerability in the Graphics: WebGPU component of Mozilla Firefox and Thunderbird. Discovered by researcher Inseo An and disclosed on April 7, 2026, it affects Firefox versions prior to 149.0.2 and Thunderbird versions prior to 149.0.2. The vulnerability carries a CVSS v3.1 base score of 8.8 (High), reflecting its network-exploitable, low-complexity nature requiring only user interaction (Mozilla Advisory, Github Advisory).

The vulnerability is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), stemming from incorrect boundary conditions in Firefox's WebGPU graphics subsystem. An attacker can exploit this flaw by crafting a malicious web page that triggers out-of-bounds memory operations when processed by the WebGPU component, potentially leading to memory corruption. Exploitation requires user interaction — specifically, a victim visiting or interacting with a malicious page — but requires no authentication or elevated privileges. Mozilla notes in the Thunderbird advisory that the flaw cannot be exploited via email because scripting is disabled in mail reading contexts, but it is a risk in browser or browser-like contexts (Mozilla Advisory, Mozilla Advisory).

Successful exploitation can result in high impact to confidentiality, integrity, and availability of the affected system. An attacker who lures a victim to a crafted web page could achieve arbitrary code execution within the browser process, potentially enabling data theft, session hijacking, or further system compromise. The scope is limited to the affected browser instance, but code execution in the browser context can serve as a foothold for broader attacks (Mozilla Advisory, Github Advisory).

No confirmed in-the-wild exploitation has been observed, and no functional proof-of-concept exploit has been verified — a GitHub repository (https://github.com/Lechansky/CVE-2026-5733) purporting to contain exploit code was assessed as empty and non-exploitable (Feedly). The EPSS score is approximately 0.036–0.043%, placing it in the lower percentiles for near-term exploitation likelihood. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Mozilla has released patches addressing this vulnerability in Firefox 149.0.2 and Thunderbird 149.0.2, announced April 7, 2026. Users should update to these versions or later immediately. As a temporary workaround prior to patching, users should avoid visiting untrusted or unknown websites. For Thunderbird users, the risk is lower since scripting is disabled in email reading contexts, but browser-like usage remains at risk (Mozilla Advisory, Mozilla Advisory).

The Center for Internet Security (CIS) issued an advisory noting that multiple vulnerabilities in Mozilla products, including CVE-2026-5733, could allow for arbitrary code execution. Tenable published detection plugins (Nessus plugin 305196 and 306139) for the vulnerability. OpenSUSE and other Linux distributions issued security announcements and package updates in response to the Firefox 149.0.2 release. No significant social media controversy or notable researcher commentary beyond standard disclosure coverage has been identified.