EUVD-2026-60748
GHSA-5gpv-5wvw-2f9q
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via web page (AV:N, PR:N), single user visit required (UI:R, AC:L); unchanged scope since impact remains within browser process; full CIA loss from privilege escalation in rendering subsystem.
Primary rating from Vendor (mozilla).
CVSS VectorVendor: mozilla
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1.
Articles & Coverage 1
AnalysisAI
Privilege escalation in Firefox's CanvasWebGL graphics component affects all Firefox releases prior to version 154 and both active ESR branches, enabling a remote attacker to gain full control over confidentiality, integrity, and availability within the browser process. The flaw stems from improper privilege management (CWE-269) in the WebGL canvas rendering pipeline, exploitable by luring a victim to a crafted web page - no authentication or special software is required beyond a standard Firefox installation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to visit an attacker-controlled web page - this is the sole mandatory user interaction (UI:R per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 score is grounded in a fully network-accessible (AV:N), low-complexity (AC:L), privilege-free (PR:N) attack requiring only a single user interaction (UI:R) - the victim visiting a malicious page - with high impact across all three CIA pillars. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious web page embedding JavaScript that invokes WebGL canvas operations specifically designed to trigger the improper privilege management flaw in Firefox's CanvasWebGL component. The victim is directed to the page via a phishing email or malvertising - once the page loads and WebGL executes automatically, the privilege escalation fires without any further user interaction, granting the attacker full control over data accessible to the Firefox process. … |
| Remediation | Vendor-released patches are available: upgrade to Firefox 154 or later, Firefox ESR 140.14 or later, or Firefox ESR 153.1 or later, per Mozilla Security Advisories MFSA2026-74, MFSA2026-76, and MFSA2026-77 at https://www.mozilla.org/security/advisories/mfsa2026-74/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Firefox installations across the organization, including ESR versions and release lines, and issue user guidance to avoid untrusted websites pending patch availability. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and b
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today