CVE-2026-92013

Incorrect boundary conditions in the Graphics: CanvasWebGL component of Mozilla Firefox allow an out-of-bounds access (CWE-120) that can be leveraged for privilege escalation, such as escaping the browser's content-process sandbox to execute code with elevated privileges. The flaw is triggered when a victim visits attacker-controlled web content that manipulates a WebGL canvas, requiring no authentication but relying on user interaction (per the CVSS vector UI:R). A successful exploit grants an attacker high impact on confidentiality, integrity, and availability on the victim's machine. All users of Firefox desktop versions prior to the fixed releases, including enterprise ESR deployments, are affected. There is no known public proof of concept and the vulnerability is not listed in CISA's KEV catalog, so exploitation status is currently none known.

What to do: Update immediately to Firefox 156 or the corresponding ESR release (115.41, 140.16, or 153.3) depending on your deployment channel; Firefox's automatic update mechanism should deliver these, but enterprise administrators managing ESR fleets should verify update policies have applied the patched builds. Until patched, users should avoid untrusted sites, since exploitation only requires visiting malicious WebGL content.