{"id":"CVE-2026-117988","kind":"vulnerability","aliases":["CVE-2026-117988"],"related":[],"title":"Firefox: boundary error in WebGL canvas lets web content escape sandbox","description":"Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"A flaw in Firefox's Graphics CanvasWebGL component lets a crafted page break out of the browser's sandbox. Sources do not say what an attacker can reach after escaping.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","desktop","firefox","runtime","webgl"],"not_affected_if":["already-updated"],"how_to_check":"- Run `firefox --version` (or check About Firefox) and compare with `159` or `153.6` for ESR\n- Confirm the installed version is below `159` (or below `153.6` on ESR)","fix":"- Update Firefox to `159` or later, or Firefox ESR to `153.6` or later","status":"open","published_at":"2026-10-27T14:16:56+00:00","first_seen_at":"2026-10-27T14:32:24+00:00","triaged_at":"2026-10-27T14:35:03+00:00","updated_at":"2026-10-27T14:35:03+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-27T14:35:03Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later, or Firefox ESR to `153.6` or later","reach":"internet","title":"Firefox: boundary error in WebGL canvas lets web content escape sandbox","impact":"high","summary":"A flaw in Firefox's Graphics CanvasWebGL component lets a crafted page break out of the browser's sandbox. Sources do not say what an attacker can reach after escaping.","category":"runtime","nicknames":[],"who_cares":["firefox","browsers","desktop","webgl"],"confidence":0.6,"needs_auth":"no","worst_case":"Web page code escapes the browser sandbox and reaches the host system","analyst_note":"Check the Mozilla advisory for the CVE-2026-117988 entry for severity, exploit conditions and whether WebGL must be enabled; the NVD record has no CVSS score yet.","how_to_check":"- Run `firefox --version` (or check About Firefox) and compare with `159` or `153.6` for ESR\n- Confirm the installed version is below `159` (or below `153.6` on ESR)","needs_analyst":true,"not_affected_if":["already-updated"],"who_is_affected":"Anyone running Firefox or Firefox ESR builds older than the fixed versions, on any device where a user browses the web. Sources do not say whether WebGL must be enabled or what platforms are most exposed. Teams that only ship managed, updated browsers can confirm the update and move on.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000597,"input_tokens":3274,"output_tokens":539,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117988':14A,17A '-2026':13A,16A '153.6':75C '159':71C 'attack':48B 'boundari':2A,58C 'break':35B 'browser':18B,39B 'canva':6A 'canvaswebgl':29B,63C 'compon':30B,64C 'condit':59C 'content':9A 'craft':33B 'cve':12A,15A 'desktop':19B 'due':55C 'error':3A 'escap':10A,52B,54C 'esr':74C 'firefox':1A,20B,26B,70C,73C 'fix':68C 'flaw':24B 'graphic':28B,62C 'incorrect':57C 'let':7A,31B 'page':34B 'reach':50B 'runtim':21B 'sandbox':11A,41B,53C 'say':45B 'sourc':42B 'vulner':66C 'web':8A 'webgl':5A,22B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox or Firefox ESR builds older than the fixed versions, on any device where a user browses the web. Sources do not say whether WebGL must be enabled or what platforms are most exposed. Teams that only ship managed, updated browsers can confirm the update and move on.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:56+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117988","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117988","severity":null,"published_at":"2026-10-27T14:16:56+00:00","modified_at":"2026-10-27T14:16:56+00:00","first_seen_at":"2026-10-27T14:32:24+00:00","fetched_at":"2026-10-27T14:32:24+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}