CVE-2026-0878
Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component
Vexday Risk Score
21Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 8EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado
Lifecycle
13 Jan 2026Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
https://access.redhat.com/errata/RHSA-2026:0667https://access.redhat.com/errata/RHSA-2026:0694https://access.redhat.com/errata/RHSA-2026:0924https://access.redhat.com/errata/RHSA-2026:1320https://access.redhat.com/errata/RHSA-2026:1413https://access.redhat.com/errata/RHSA-2026:1414https://access.redhat.com/errata/RHSA-2026:1415https://access.redhat.com/errata/RHSA-2026:1461https://access.redhat.com/errata/RHSA-2026:1462https://access.redhat.com/errata/RHSA-2026:1471https://access.redhat.com/errata/RHSA-2026:1487https://access.redhat.com/errata/RHSA-2026:2041