Executive brief
Firefox and Thunderbird contain a vulnerability in their WebGL graphics rendering component that could allow an attacker to execute code with elevated privileges. An attacker could exploit this issue through a specially crafted web page, potentially gaining control over sensitive user data or system resources without requiring any special user permissions beyond visiting the malicious site.
Technical details
This vulnerability is a privilege escalation flaw caused by incorrect boundary conditions in the Graphics: CanvasWebGL component. The root cause is improper validation of buffer boundaries when processing WebGL canvas operations, allowing an attacker to write beyond allocated memory regions. The attack requires no authentication and is triggered via network—an attacker crafts a malicious webpage containing specially formed WebGL commands that, when rendered by the browser, trigger the boundary condition. Successful exploitation allows arbitrary code execution in the renderer process context. Patches are available in Firefox 156, Firefox ESR 115.41, ESR 140.16, ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
Affected products
- Mozilla Firefox before 156
- Mozilla Firefox ESR 115.x before 115.41, 140.x before 140.16, 153.x before 153.3
- Mozilla Thunderbird before 156, 140.x before 140.16, 153.x before 153.3
Timeline
- 2026-09-15: disclosed: CVE-2026-92013 published in Mozilla Security Advisory MFSA2026-90
- 2026-09-15: patched: Fixed in Firefox 156, Firefox ESR 115.41, 140.16, 153.3, Thunderbird 156, 140.16, 153.3