{"id":"CVE-2026-117866","kind":"vulnerability","aliases":["CVE-2026-117866"],"related":[],"title":"Firefox: use-after-free in Canvas2D lets a page escalate privileges","description":"Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.","summary":"A use-after-free bug in Firefox's Canvas2D graphics component can be abused to escalate privileges. The sources do not say what the attacker gains beyond that or whether web content alone can trigger it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","desktop","firefox","runtime"],"not_affected_if":["firefox-not-installed"],"how_to_check":"- Run `firefox --version` (or check About Firefox) and compare against the fixed versions `159`, `115.44` ESR and `153.6` ESR\n- Check the Firefox ESR line in use, for example `115.x` or `153.x`, and confirm it is at or above the fixed build","fix":"- Upgrade Firefox to `159` or later\n- Upgrade Firefox ESR to `115.44` or `153.6`, or later builds on those branches","status":"open","published_at":"2026-10-27T14:16:41+00:00","first_seen_at":"2026-10-27T14:32:21+00:00","triaged_at":"2026-10-27T14:39:19+00:00","updated_at":"2026-10-27T14:39:19+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-27T14:39:19Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Firefox to `159` or later\n- Upgrade Firefox ESR to `115.44` or `153.6`, or later builds on those branches","reach":"unknown","title":"Firefox: use-after-free in Canvas2D lets a page escalate privileges","impact":"high","summary":"A use-after-free bug in Firefox's Canvas2D graphics component can be abused to escalate privileges. The sources do not say what the attacker gains beyond that or whether web content alone can trigger it.","category":"runtime","nicknames":[],"who_cares":["firefox","desktop","browser"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; sources say only privilege escalation","analyst_note":"Check the Mozilla security advisory for this CVE to confirm the trigger (web content or not), the exploit status and the exact fixed versions.","how_to_check":"- Run `firefox --version` (or check About Firefox) and compare against the fixed versions `159`, `115.44` ESR and `153.6` ESR\n- Check the Firefox ESR line in use, for example `115.x` or `153.x`, and confirm it is at or above the fixed build","needs_analyst":true,"not_affected_if":["firefox-not-installed"],"who_is_affected":"Any installation of Firefox or Firefox ESR older than the fixed builds is in scope, including managed desktops and kiosks. The sources do not say whether a page loaded in a browser is enough to trigger it, or whether a configuration or feature must be enabled. Teams that do not run Firefox can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000619,"input_tokens":3272,"output_tokens":583,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117866':15A,18A '-2026':14A,17A '115.44':81C '153.6':85C '159':78C 'abus':37B 'alon':56B 'attack':48B 'beyond':50B 'browser':19B 'bug':28B 'canvas2d':7A,32B,70C 'compon':34B,71C 'content':55B 'cve':13A,16A 'desktop':20B 'due':61C 'escal':11A,39B,60C 'esr':80C,84C 'firefox':1A,21B,30B,77C,79C,83C 'fix':75C 'free':5A,27B,66C 'gain':49B 'graphic':33B,69C 'let':8A 'page':10A 'privileg':12A,40B,59C 'runtim':22B 'say':45B 'sourc':42B 'trigger':58B 'use':3A,25B,64C 'use-after-fre':2A,24B,63C 'vulner':73C 'web':54B 'whether':53B","nicknames":[],"mitigations":[],"who_affected":"Any installation of Firefox or Firefox ESR older than the fixed builds is in scope, including managed desktops and kiosks. The sources do not say whether a page loaded in a browser is enough to trigger it, or whether a configuration or feature must be enabled. Teams that do not run Firefox can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:41+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117866","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117866","severity":null,"published_at":"2026-10-27T14:16:41+00:00","modified_at":"2026-10-27T14:16:41+00:00","first_seen_at":"2026-10-27T14:32:21+00:00","fetched_at":"2026-10-27T14:32:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}