CVE-2026-92010

Mozilla Firefox contains a privilege escalation flaw caused by incorrect boundary conditions (CWE-120, buffer overflow) in the Graphics: CanvasWebGL component. An attacker can trigger it by convincing a target user to visit a web page that feeds specially crafted data to the WebGL canvas rendering pipeline, requiring no privileges but some user interaction. Successful exploitation yields high impact on confidentiality, integrity, and availability, meaning an attacker could potentially escape the content-process sandbox and execute code with elevated browser privileges. All users of Firefox release and ESR branches prior to the fixed versions are affected. No public proof-of-concept exists and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog.

What to do: Update immediately to Firefox 156, or to Firefox ESR 115.41, 140.16, or 153.3 depending on your ESR branch. Verify that automatic updates are enabled on managed endpoints, and check enterprise/ESR deployments where updates are often staggered or deferred. Since exploitation requires only a user visiting a malicious page, treat unpatched browsers as high priority for patching this cycle.