CVE-2026-12324: Incorrect boundary conditions in the Graphics: CanvasWebGL component

Synopsis

An incorrect boundary condition vulnerability in the Graphics: CanvasWebGL component affects all versions of Mozilla Firefox and Thunderbird. The flaw is reachable over the network with no authentication required and no user interaction needed beyond normal browsing. Successful exploitation allows an attacker to read data from the affected process, modify in-memory state, and crash the application. A patched-image rebuild at Firefox 152 and Firefox ESR 140.12 (and the corresponding Thunderbird releases) is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable component is exposed over the network, meaning an attacker can reach it from the internet or any network-adjacent position without requiring local system access.

• AuthenticationNot required

  No account or credential of any privilege level is needed to deliver a malicious payload to the affected component.

• Victim interactionNot required

  The attack can be carried out without any action from a user beyond normal use of the browser or mail client.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, specific memory layouts, or environmental prerequisites must be satisfied for the attack to succeed.

Blast Radius

• A successful attacker reads data from the renderer process memory, which may include page content, session state, or other in-scope data.
• A successful attacker modifies in-scope memory or in-process state, potentially altering rendered content or injecting data into the affected context.
• A successful attacker crashes the affected Firefox or Thunderbird process, causing a denial of service for the user session.