Mozilla Firefox EUVD-2026-98641

Exploitation requires the victim to actively load attacker-controlled web content that exercises the CanvasWebGL (WebGL/HTML canvas) graphics rendering path in Firefox - the specific component named in the advisory. Because the flaw is a race condition (CWE-362), the attacker must win a non-deterministic timing window, which the CVSS AC:H rating reflects and which substantially limits reliable exploitation. Further limiting factors: mandatory user interaction (UI:R - the victim must visit the page), impact confined to limited information disclosure (C:L/I:L, no availability or code-execution impact in the vector), and the issue being fixed in Firefox 158, ESR 115.43, and ESR 153.5, so only unpatched installations below those versions are exposed. No special non-default browser configuration is indicated.

This is a genuinely low-priority issue despite being a memory-safety flaw (CWE-362 race condition leading to use-after-free in the CanvasWebGL graphics component). The CVSS 3.1 base score of 4.2 (Medium) is driven down by three limiting metrics: AC:H (the race condition requires winning a timing window, which is non-deterministic and hard to reliably trigger), UI:R (a victim must actively load attacker-controlled content), and the impact being only C:L/I:L/A:N (limited information disclosure, no code execution or crash reflected in the metrics). All exploitation signals agree on low risk: CISA's SSVC framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'. There is no CISA KEV listing and no public exploit identified, so this is no public exploit identified at time of analysis. No EPSS score was provided in the input, so probabilistic exploitation likelihood could not be cross-referenced. The signals are consistent rather than conflicting - a high-complexity, user-interaction-dependent, information-disclosure-only bug that Mozilla fixed as part of routine browser hardening. Note one point of nuance to verify: the impact metrics (C:L/I:L) and the 'Information Disclosure' tag suggest a memory read/leak primitive, whereas a classic use-after-free often also carries availability/RCE potential (A:N here implies it does not) - the limited impact scoring should be confirmed against Mozilla's advisory severity rating.

An attacker crafts a malicious web page containing WebGL/canvas content that races the browser's graphics operations to trigger the use-after-free, then lures a victim into visiting it. Because exploitation depends on winning a non-deterministic timing window (AC:H) and the victim actively loading the page (UI:R), success is unreliable and most likely yields a limited memory-information leak rather than code execution. No public proof-of-concept exploit was identified at the time of analysis.