Firefox ESR EUVD-2026-88810

Exploitation requires a victim using an affected Firefox ESR build (prior to 153.4, 140.17, or 115.42) to load attacker-controlled web content that exercises the Canvas2D component - the JavaScript 2D graphics rendering path, which is enabled by default and needs no special configuration. The key limiting factor is required user interaction (UI:R): the victim must be induced to visit a malicious or compromised page; there is no server-side or unauthenticated-service exposure. Impact is confined to the content process (S:U, no sandbox-escape scope change indicated). Note the referenced fixes cover only ESR channels - confirm applicability to mainline Firefox 157 with the vendor.

This is a memory-safety vulnerability (CWE-416 use-after-free) in Firefox's Graphics: Canvas2D component, carrying a legitimately high CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) that reflects RCE-class technical impact - full confidentiality, integrity, and availability loss within the exploited content process. However, the raw score overstates near-term operational urgency once other signals are weighed. CISA SSVC data shows Exploitation: none (no observed exploitation), Automatable: no (requires per-victim social engineering to lure a user to a malicious page, consistent with UI:R), and Technical Impact: total. There is no EPSS score, no CISA KEV listing, and no public POC in the provided intelligence - exploitation status is 'no public exploit identified at time of analysis.' The C:H/I:H/A:H triad plus the 'Information Disclosure' tag slightly overstate a pure info-leak angle; a Canvas2D UAF is primarily memory corruption that leads to code execution, not a read primitive. One notable discrepancy: this CVE's fix references list ONLY the ESR advisories (MFSA2026-98, -99, -100) and ESR builds (153.4, 140.17, 115.42), with no mainline Firefox 157 advisory (MFSA2026-97) present - verify whether current-channel Firefox is also affected, since the CPE 'cpe:2.3:a:mozilla:firefox' is generic. Net: a real bug worth patching promptly given Firefox's ubiquity, but not an emergency - no active exploitation, no automation, and mitigation requires user interaction.

An attacker crafts a malicious web page containing JavaScript that manipulates Canvas2D drawing operations to trigger the use-after-free, then lures a victim into visiting it (UI:R). Reclaiming the freed object with attacker-controlled data yields memory corruption in the content process, which a skilled attacker can shape toward arbitrary code execution or sensitive-memory disclosure. No public exploit code is identified at time of analysis, and CISA SSVC rates exploitation as none and non-automatable.