CVE-2026-109719

Race condition, use-after-free in the Graphics: CanvasWebGL component

Published Oct 13, 2026 CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Description

Race condition, use-after-free in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Analysis

Technical impact

The CanvasWebGL component contains a race condition that can trigger a use‑after‑free bug. The entry does not detail any exploitation or specific consequence beyond the risk of memory corruption or corrupt state due to the freed memory reference.

Affected Systems

Mozilla Firefox and Mozilla Thunderbird on any platform where the CanvasWebGL component is enabled. The flaw affects versions earlier than Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird ESR 153.5.

Risk and Exploitability

The CVSS score of 4.2 indicates moderate severity and the EPSS score of less than 1% suggests that exploitation is unlikely to occur widely. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require delivery of a malicious WebGL payload to an unprivileged user’s browser, implying that attack edges are limited to web page interaction.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mozilla

Firefox

affected

Version	Status	Constraints
`115.43`	unaffected	≤ 115.*
`153.5`	unaffected	≤ 153.*
`158`	unaffected	≤ *

Mozilla

Thunderbird

affected

Version	Status	Constraints
`153.5`	unaffected	≤ 153.*
`158`	unaffected	≤ *

No data.

Vendor Product Versions

Mozilla

Firefox

Version	Status	Scheme	Platform
`[115.43,115.*]`	unaffected	generic	—
`[153.5,153.*]`	unaffected	generic	—
`[158,*]`	unaffected	generic	—

Mozilla

Thunderbird

Version	Status	Scheme	Platform
`[153.5,153.*]`	unaffected	generic	—
`[158,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to Firefox 158 or newer (or ESR 115.43/153.5) and Thunderbird 158 or newer (or ESR 153.5).
If an immediate update is not feasible, disable WebGL by setting media.webgl.enabled to false or through group policy settings.
Implement a Content Security Policy that blocks WebGL or restricts creation of WebGL contexts.

Generated by OpenCVE AI on October 17, 2026 at 08:35 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4836-1	firefox-esr security update
Debian DLA	DLA-4863-1	thunderbird security update
Debian DSA	DSA-6560-1	firefox-esr security update

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.172% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=2073969
https://www.mozilla.org/security/advisories/mfsa2026-106/
https://www.mozilla.org/security/advisories/mfsa2026-107/
https://www.mozilla.org/security/advisories/mfsa2026-108/
https://www.mozilla.org/security/advisories/mfsa2026-109/
https://www.mozilla.org/security/advisories/mfsa2026-110/

History

Oct 14, 2026 9:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla firefox Mozilla thunderbird
Vendors & Products		Mozilla Mozilla firefox Mozilla thunderbird

Oct 13, 2026 6:30 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	Race condition, use-after-free in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.	Race condition, use-after-free in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
References		https://www.mozilla.org/security/advisories/mfsa2026-109/ https://www.mozilla.org/security/advisories/mfsa2026-110/

Oct 13, 2026 3:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-416
Metrics		cvssV3_1 `{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 13, 2026 1:00 PM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description		Race condition, use-after-free in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.
Title		Race condition, use-after-free in the Graphics: CanvasWebGL component
References		https://bugzilla.mozilla.org/show_bug.cgi?id=2073969 https://www.mozilla.org/security/advisories/mfsa2026-106/ https://www.mozilla.org/security/advisories/mfsa2026-107/ https://www.mozilla.org/security/advisories/mfsa2026-108/