Live › vulnerability › CVE-2026-117866
Go to dashboardA use-after-free bug in Firefox's Canvas2D graphics component can be abused to escalate privileges. The sources do not say what the attacker gains beyond that or whether web content alone can trigger it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Any installation of Firefox or Firefox ESR older than the fixed builds is in scope, including managed desktops and kiosks. The sources do not say whether a page loaded in a browser is enough to trigger it, or whether a configuration or feature must be enabled. Teams that do not run Firefox can skip it.
No product ranges from the sources yet.
firefox --version (or check About Firefox) and compare against the fixed versions 159, 115.44 ESR and 153.6 ESR115.x or 153.x, and confirm it is at or above the fixed build159 or later115.44 or 153.6, or later builds on those branchesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117866")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.