The vulnerability is a sandbox escape caused by incorrect boundary conditions in the Graphics: CanvasWebGL component, which can let an attacker read or write memory outside the intended bounds. The weakness involves improper input validation and buffer management, as reflected by the identified CWEs such as CWE-119 and CWE-20.

Mozilla Firefox and Thunderbird are impacted. Versions earlier than Firefox 147 or Firefox ESR 140.7, and earlier than Thunderbird 147 or Thunderbird ESR 140.7, are vulnerable. Any release prior to these thresholds remains at risk.

The CVSS score of 8.0 indicates high severity, while an EPSS score of less than 1% implies a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, meaning no widespread exploit reports exist. The likely attack vector involves an attacker supplying crafted content that triggers the CanvasWebGL component, such as a malicious web page or an email message that renders WebGL; this inference is made because the component is invoked during content rendering and the description indicates a sandbox escape. Attackers would need to supply such crafted content to achieve the exploit.