EUVD-2026-60677
GHSA-g7qh-rpm5-5c52
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via malicious web content, user must load the page (UI:R), no privileges needed; full C/I/A within browser scope justified by privilege escalation with total technical impact.
Primary rating from Vendor (mozilla).
CVSS VectorVendor: mozilla
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 154 and Firefox ESR 153.1.
Articles & Coverage 1
AnalysisAI
Privilege escalation via invalid pointer dereference in Mozilla Firefox's Graphics component allows a remote attacker to gain elevated privileges within the browser context. Affected versions are all Firefox releases prior to 154 and all Firefox ESR releases prior to 153.1, with patches confirmed in Mozilla advisories mfsa2026-74 and mfsa2026-77. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | User interaction is required: a victim must actively navigate to or load attacker-controlled web content in an unpatched Firefox browser (UI:R per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 score is driven by a network attack vector, low complexity, no required privileges, but mandatory user interaction (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), placing this firmly in the high-severity tier. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious web page or advertisement containing specially constructed graphics content - such as a manipulated canvas, WebGL scene, or GPU-accelerated rendering call - designed to trigger the invalid pointer condition in Firefox's Graphics component. When a victim browses to or is redirected to this content without upgrading to Firefox 154 or ESR 153.1, the invalid pointer is dereferenced, corrupting memory in the browser process and enabling the attacker to escalate privileges within the browser's execution context, potentially accessing sensitive browsing data or executing attacker-controlled code. … |
| Remediation | Vendor-released patch: Firefox 154 and Firefox ESR 153.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct inventory of Firefox deployments across the organization, identifying all instances running versions prior to Firefox 154 or ESR 153.1. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and b
Same weakness CWE-763 – Release of Invalid Pointer or Reference
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today