A flaw in the Graphics: Canvas2D component lets a malicious script read pixel data from a canvas that was rendered with content from a different origin. The result is an information disclosure that bypasses the browser’s same‑origin policy, exposing data that could include sensitive user content, crumbs of private information, or other data normally protected by origin boundaries. The weakness is aligned with information‑exposure weaknesses such as CWE‑200 and CWE‑346.

Mozilla Firefox releases 142 and all current ESR releases (115.27, 128.14, 140.2) and Mozilla Thunderbird releases 142 and all current ESR releases (115.27, 128.14, 140.2) are affected. Earlier versions of these products are vulnerable.

The CVSS score of 8.1 indicates a high severity, while the EPSS of less than 1% suggests a low likelihood of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog, which indicates that it has not yet been the target of known, active exploitation campaigns. Attackers would need to lure a user to a malicious web page or send them a malicious email that triggers the Canvas2D rendering, which means the risk exists in typical browser usage scenarios.