Description
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
Published: 2026-09-15
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Apply Patch
AI Analysis

Impact

A flaw in the CanvasWebGL component of Mozilla browsers allows an attacker to exploit incorrect boundary checks, potentially elevating privileges. The vulnerability is designated as a buffer-related weakness (CWE-120) and is cataloged with a high CVSS score of 8.8.

Affected Systems

The issue affects Mozilla's Firefox and Thunderbird products. Fixed versions include Firefox 156, Firefox ESR 115.41, 140.16, and 153.3, as well as Thunderbird 156 and Thunderbird 140.16.

Risk and Exploitability

With a CVSS of 8.8, the severity is high. The EPSS score is very low, under 1%, and the vulnerability is not listed in KEV, indicating limited public exploitation so far. The attack vector is likely remote via a malicious web page that triggers the CanvasWebGL component, although the official description does not explicitly state the vector.

Generated by OpenCVE AI on September 20, 2026 at 17:32 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Firefox to version 156 or newer, or apply the corresponding ESR upgrade (115.41, 140.16, or 153.3).
  • Upgrade Thunderbird to version 156 or newer, or apply the corresponding ESR upgrade (140.16 or 153.3).
  • If upgrading immediately is not feasible, restrict WebGL usage through configuration or capability policies to mitigate exposure until a patch can be applied.

Generated by OpenCVE AI on September 20, 2026 at 17:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4781-1 firefox-esr security update
Debian DLA Debian DLA DLA-4782-1 thunderbird security update
Debian DSA Debian DSA DSA-6501-1 firefox-esr security update
Debian DSA Debian DSA DSA-6503-1 thunderbird security update
History

Thu, 17 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-266
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 16 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
Description Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16. Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
References

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, and Thunderbird 140.16. Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16.
References

Tue, 15 Sep 2026 20:00:00 +0000

Type Values Removed Values Added
Description Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3. Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, and Thunderbird 140.16.
References

Tue, 15 Sep 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 15 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-120
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 12:45:00 +0000

Type Values Removed Values Added
Description Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.
Title Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
References

Subscriptions

Mozilla Firefox
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-09-16T14:24:31.583Z

Reserved: 2026-09-15T12:33:31.399Z

Link: CVE-2026-92012

cve-icon Vulnrichment

Updated: 2026-09-15T13:40:53.410Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T13:16:49.310

Modified: 2026-09-16T19:34:05.910

Link: CVE-2026-92012

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-15T12:33:31Z

Links: CVE-2026-92012 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T17:45:07Z

Weaknesses
  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

  • CWE-266

    Incorrect Privilege Assignment