Live › vulnerability › CVE-2026-117988
Go to dashboardA flaw in Firefox's Graphics CanvasWebGL component lets a crafted page break out of the browser's sandbox. Sources do not say what an attacker can reach after escaping.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running Firefox or Firefox ESR builds older than the fixed versions, on any device where a user browses the web. Sources do not say whether WebGL must be enabled or what platforms are most exposed. Teams that only ship managed, updated browsers can confirm the update and move on.
No product ranges from the sources yet.
firefox --version (or check About Firefox) and compare with 159 or 153.6 for ESR159 (or below 153.6 on ESR)159 or later, or Firefox ESR to 153.6 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117988")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.