---
id: "CVE-2026-117866"
kind: "vulnerability"
aliases: ["CVE-2026-117866"]
title: "Firefox: use-after-free in Canvas2D lets a page escalate privileges"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["browser", "desktop", "firefox", "runtime"]
not_affected_if: ["firefox-not-installed"]
published_at: "2026-10-27T14:16:41+00:00"
first_seen_at: "2026-10-27T14:32:21+00:00"
updated_at: "2026-10-27T14:39:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117866", "first_seen_at": "2026-10-27T14:32:21+00:00"}]
---

# Firefox: use-after-free in Canvas2D lets a page escalate privileges

A use-after-free bug in Firefox's Canvas2D graphics component can be abused to escalate privileges. The sources do not say what the attacker gains beyond that or whether web content alone can trigger it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `firefox --version` (or check About Firefox) and compare against the fixed versions `159`, `115.44` ESR and `153.6` ESR
- Check the Firefox ESR line in use, for example `115.x` or `153.x`, and confirm it is at or above the fixed build

## Fix

- Upgrade Firefox to `159` or later
- Upgrade Firefox ESR to `115.44` or `153.6`, or later builds on those branches

## Timeline

- 2026-10-27T14:32:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117866

## From the sources

Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_