EUVD-2026-37070
GHSA-p449-4x9g-97vg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Browser flaw requires victim to load attacker page (UI:R); information-disclosure tag and Low impact metrics support C:L/A:L with no integrity impact.
Primary rating from Vendor (mozilla).
CVSS VectorVendor: mozilla
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
3DescriptionCVE.org
Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 152 and Firefox ESR 140.12.
Articles & Coverage 1
AnalysisAI
Memory safety flaw in the CanvasWebGL graphics component of Mozilla Firefox allows remote attackers to trigger incorrect boundary handling through crafted web content, leading to limited confidentiality, integrity, and availability impact. The issue affects Firefox prior to version 152 and Firefox ESR prior to 140.12, and no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Victim must run an unpatched Firefox (<152) or Firefox ESR (<140.12) build with WebGL enabled (the default configuration) and load attacker-controlled web content in a context where JavaScript and the CanvasWebGL API are permitted. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L yields 7.3 (High) and reflects browser-style remote drive-by exposure: any user visiting a malicious page can be targeted without authentication or interaction prompts. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a malicious web page containing crafted JavaScript that invokes WebGL canvas operations with boundary-edge parameters; when a victim navigates to the page in an unpatched Firefox, the CanvasWebGL component mishandles the input and leaks memory contents or destabilizes the renderer process. The attacker could combine this with social engineering (phishing link, malvertising) to broaden reach, and no public exploit identified at time of analysis means active campaigns are not currently documented. |
| Remediation | Vendor-released patch: upgrade to Firefox 152 or Firefox ESR 140.12 (or later) as documented in Mozilla advisories MFSA2026-57, MFSA2026-58, MFSA2026-60, and MFSA2026-61 at https://www.mozilla.org/security/advisories/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Firefox deployments, particularly ESR instances in production environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Unauthenticated remote command execution in rclone's remote control daemon (rcd) affects versions 1.55.0 through 1.74.2
Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 152 and Firefox
Security mitigation bypass in the DOM: Security component of Mozilla Firefox allows remote attackers to circumvent brows
Security mitigation bypass in the DOM: Security component of Mozilla Firefox prior to version 152 allows remote attacker
Privilege escalation in the WebRender graphics component of Mozilla Firefox enables remote attackers to elevate privileg
Share
External POC / Exploit Code
Leaving vuln.today