---
id: "CVE-2026-117888"
kind: "vulnerability"
aliases: ["CVE-2026-117888"]
title: "Firefox: uninitialized memory in Canvas2D can expose data"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["browsers", "desktop", "firefox", "runtime"]
not_affected_if: ["already-on-fixed-version"]
published_at: "2026-10-27T14:16:44+00:00"
first_seen_at: "2026-10-27T14:32:21+00:00"
updated_at: "2026-10-27T14:37:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117888", "first_seen_at": "2026-10-27T14:32:21+00:00"}]
---

# Firefox: uninitialized memory in Canvas2D can expose data

Firefox's Canvas2D graphics component reads memory that was never initialized, which can leak or corrupt data in the browser process. Sources do not say whether an attacker can turn this into code execution or a page-only leak.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `firefox --version` (or check About Firefox) and compare against the fixed versions `159` and `153.6` for ESR
- unknown for other checks; the sources do not list them

## Fix

- Update Firefox to `159` or later, or Firefox ESR to `153.6` or later
- unknown for other mitigations; the sources do not say

## Timeline

- 2026-10-27T14:32:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117888

## From the sources

Uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_