The CanvasWebGL component in Mozilla’s browsers and email client performs improper boundary checks, allowing a malicious actor to escape the sandbox and execute code or read local files. This defect is categorized as CWE‑754, an improper restriction of operations within the bounds of a resource. The consequence is the ability for an attacker to gain full remote code execution on a vulnerable system.

Users of Mozilla Firefox versions before 146 (including ESR 115.x and ESR 140.x releases) and users of Mozilla Thunderbird versions before 146 (including ESR 140.x) are affected. All builds containing the CanvasWebGL component prior to the stated patch dates are vulnerable.

The vulnerability carries a high CVSS score of 8.0, reflecting significant potential impact. Its EPSS score is below 1 %, indicating a low probability of exploitation at this time, and it is not listed in the CISA KEV catalog. The likely attack vector involves loading a crafted WebGL scene from a malicious web page or an email attachment, which triggers the boundary error and causes the sandbox escape, potentially leading to arbitrary code execution.