Mozilla Firefox CVE-2026-109711

Exploitation requires the victim to open attacker-controlled web content that exercises the Graphics: Canvas2D rendering path - consistent with UI:R in the CVSS vector. No authentication is required (PR:N, unauthenticated remote attacker), and the affected code is reachable in default Firefox configurations with JavaScript/Canvas enabled. The primary limiting factor is the mandatory user interaction: the attacker must get the user to load a malicious or compromised page; there is no server-side or passive exposure. Affected builds are Firefox before 158 and Firefox ESR before 153.5; patched versions are not vulnerable.

This is a moderate-severity memory-safety flaw (CWE-416 use-after-free) in Firefox's Graphics: Canvas2D component with a CVSS 3.1 base of 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N). The signals are internally consistent and point to a lower-priority issue despite the ubiquitous product: the CVSS vector requires user interaction (UI:R), delivers only partial confidentiality and integrity impact (C:L/I:L), and no availability impact (A:N). CISA's SSVC framework corroborates this - Exploitation is 'none' (no observed or public exploitation), Automatable is 'no' (requires luring a victim to malicious content, not mass-scannable), and Technical Impact is 'partial'. No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of active exploitation or available exploit code. Note one modeling caveat: use-after-free bugs in browser graphics engines can sometimes be escalated beyond the low C/I impact Mozilla assigned (e.g., toward code execution), so the memory-corruption tag suggests the rated impact may be conservative - but nothing in the provided data elevates real-world urgency. Bottom line: patch within normal cycles, not an emergency.

An attacker hosts a malicious web page containing crafted Canvas2D drawing operations and lures a Firefox user to visit it. The page triggers a use-after-free in the graphics code, letting the attacker read a limited amount of adjacent memory (potential information disclosure). No public exploit code was identified at time of analysis, and the attack cannot succeed without the victim loading the attacker-controlled content (UI:R).