CVE-2026-117990

LOWCVSS 9.6 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-119

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Full discourse1 post

Upwind Security MDR@UpwindMDR1d
🚨Critical - Firefox & Thunderbird: three sandbox escapes in graphics and widget code (CVE-2026-117988, CVE-2026-117990, CVE-2026-117997) Malicious web content can break out of the content sandbox three ways: incorrect boundary conditions in CanvasWebGL and in WebRender, plus a use-after-free in the Widget component. All are remote, unauthenticated and need only that the victim loads the page — scope-changed 9.6, meaning code running outside the sandbox on the host. 👉Affected: Firefox < 159, ESR < 153.6, Thunderbird < 159 / < 153.6 (117997 is Firefox only) | Upgrade now
0000080
389 followersView on X

Explore more

Back to dashboard