The flaw originates from an uninitialized memory area within the Graphics: Canvas2D component, allowing data that should not be accessible to be read. This can expose sensitive information such as memory contents that may include cryptographic keys, credentials, or other confidential data. The vulnerability is an information‑disclosure issue and does not directly lead to code execution or denial of service.

Mozilla Firefox users are impacted if their browsers are running a version prior to Firefox 150 or the ESR releases Firefox 115.35 or Firefox 140.10. The Canvas2D component exists in all these releases, and the patch that addresses the flaw is contained in the stated versions.

No EPSS score is published, so the likelihood of exploitation cannot be quantified, and the vulnerability is not listed in CISA’s KEV catalogue. Based on the description, the likely attack vector is either a local user able to load or render arbitrary canvas content, or a remote attacker delivering a crafted HTML page that triggers the vulnerability in the browser’s rendering engine. The flaw would allow the attacker to read data that was never initialized, potentially leaking confidential information. The CVSS assessment is not available in the supplied data, so users should assume a high risk and treat the vulnerability as a critical confidentiality compromise.