● High · CVSS 8.0

How to Fix CVE-2026-0878: Firefox and Thunderbird WebGL sandbox escape

Q: Is CVE-2026-0878 on the CISA KEV catalog or being exploited?

No. CVE-2026-0878 is not on the CISA Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment records Exploitation as none. No public exploit is linked in the Mozilla advisory. It is still rated high (CVSS 8.0), so update on a normal prompt schedule.

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

⚡ At a glance

Severity	High, CVSS 3.1 base 8.0 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N)
Actively exploited?	No. Not on CISA KEV; CISA SSVC Exploitation: none
Affected	Mozilla Firefox, Firefox ESR, and Thunderbird before the fixed builds below (Graphics: CanvasWebGL component)
Fixed in	Firefox 147, Firefox ESR 140.7, Thunderbird 147, Thunderbird 140.7
Type (CWE)	CWE-119 (out-of-bounds memory access) and CWE-20 (improper input validation). Together they make a sandbox escape

Exploitation status

CVE-2026-0878 is not on the CISA Known Exploited Vulnerabilities (KEV) catalog, and CISA's SSVC vulnrichment records Exploitation: none, Automatable: no, Technical Impact: partial. There is no U.S.-government-confirmed in-the-wild exploitation on record. That is not a guarantee of safety, because assessments lag real abuse, but it does mean you can patch on a normal prompt schedule rather than treating this as an emergency.

Public exploit availability: no public exploit or Metasploit module is linked in Mozilla's advisories for this issue at the time of writing. The flaw was reported by Oskar L through Mozilla's process and fixed before any public abuse surfaced. Because it requires the victim to load attacker-controlled content (CVSS UI:R, AC:H), it is not the kind of bug that mass scanners can automate, which matches the SSVC "Automatable: no" rating.

Authoritative references:

What is CVE-2026-0878?

CVE-2026-0878 is a sandbox escape caused by incorrect boundary conditions in the Graphics: CanvasWebGL component of Mozilla's Gecko engine. It affects both Firefox and Thunderbird, because Thunderbird is built on the same engine and ships the same WebGL rendering code. Mozilla assigned it through MFSA 2026-01 and the related 2026-03/04/05 advisories, and credited the report to Oskar L.

WebGL is the browser API that lets a web page render hardware-accelerated 2D and 3D graphics on a <canvas> element. To do that safely, the rendering code runs inside Firefox's content sandbox, a restricted process that is supposed to contain anything a hostile page does. The "incorrect boundary conditions" here mean the CanvasWebGL code mishandles the limits of a buffer or an index when processing graphics commands, which lines up with the two assigned weaknesses: CWE-119, improper restriction of operations within the bounds of a memory buffer, and CWE-20, improper input validation. When a value crosses a boundary it should not, the content process can be steered into doing something the sandbox was meant to prevent , that is the "escape."

Read the CVSS vector carefully, because it tells you exactly how this behaves. AV:N means the attack arrives over the network (a web page or remote message). UI:R means the victim has to do something, namely load the malicious content. AC:H means the attack is not trivially reliable; it takes specific conditions. S:C (scope changed) is the part that matters most: a successful escape lets code break out of the constrained content process into a more privileged context. C:H/I:H means high confidentiality and integrity impact, while A:N means it is not primarily a crash or denial-of-service bug. The composite is 8.0, High , serious, but not the "critical" label the earlier version of this page wrongly carried.

Why this CVE matters

A browser sandbox is the last line of defence between a hostile web page and your operating system. Most browser bugs that get reported stay trapped inside the content process, where they can corrupt a tab but not your files or your credentials. A sandbox escape removes that containment. On its own this flaw needs the user to visit attacker content, so it is not a wormable, internet-facing server hole. But it is exactly the kind of primitive attackers chain together: a content-process bug plus a sandbox escape such as this one is how a single malicious page turns into real access on the machine.

The Thunderbird angle is easy to overlook and worth stating plainly. Thunderbird renders HTML email through the same Gecko engine, so a message that pulls in remote WebGL content can reach the same vulnerable code path. If your organisation patches Firefox aggressively but treats Thunderbird as a low-risk desktop app, this is the CVE that catches you out. Both products are fixed in the same release wave, so patch them together.

Identify whether you are affected

You are affected if you run a Firefox, Firefox ESR, or Thunderbird build older than the fixed versions on its branch. There is nothing network-facing to scan here , this is desktop client software, so the question is simply which version is installed on each machine.

To check Firefox: open the menu (☰) → Help → About Firefox, or type about:support in the address bar and read the "Version" field. To check Thunderbird: open the menu → Help → About Thunderbird. Compare what you see against the fixed builds:

Firefox (rapid release): fixed in 147. Anything below 147 on the rapid-release channel is vulnerable.
Firefox ESR: fixed in 140.7. If you run the 140 ESR line, you need 140.7 or later.
Thunderbird (release): fixed in 147.
Thunderbird ESR/140 line: fixed in 140.7.

For a managed fleet, query the version centrally instead of walking desks. On Windows, your endpoint management tool can read the file version of firefox.exe / thunderbird.exe. On macOS, read CFBundleShortVersionString from the app's Info.plist. On Linux, ask the package manager that installed the browser (for example rpm -q firefox or dpkg -l firefox) , but remember the fix is the Mozilla version number, not a distro build string, so always map back to 147 or 140.7.

How to fix CVE-2026-0878

The fix is to update to a build that is at or above the fixed version for your channel. There is no configuration workaround that closes the bug; the patched binary is the remediation. Pick the path that matches how the software was installed.

Update a normal desktop install (Windows / macOS)

On a standard Mozilla build, the updater does the work for you:

Open Firefox → menu (☰) → Help → About Firefox. The dialog checks for updates and downloads the latest build automatically.
Click Restart to update Firefox when prompted. Firefox restores your tabs after the restart.
Do the same in Thunderbird via Help → About Thunderbird, then restart it.
Re-open the About dialog and confirm the version now reads 147 (release) or 140.7 (ESR) or higher.

If automatic updates were disabled by policy, download the current installer directly from mozilla.org/firefox or thunderbird.net and run it over the existing install. Settings, profiles, and add-ons are preserved.

Update Firefox ESR (managed / enterprise desktops)

If you standardise on the Extended Support Release, the fixed build is ESR 140.7. Deploy the 140.7 ESR installer through your usual mechanism , Group Policy / Microsoft Intune with the Mozilla ADMX templates, an MSI package, Jamf or Munki on macOS , and let the in-product updater handle the increment if you allow it. Confirm the resulting version is 140.7 or later in about:support. Do not skip the ESR line on the assumption it is "older and safer"; ESR before 140.7 is affected.

Update a Linux distribution package

If Firefox or Thunderbird came from your distribution rather than from Mozilla directly, install the updated package once your distro has rebuilt against the fixed Mozilla source. Use the package manager that owns the install, then confirm the version maps to 147 or 140.7:

# Debian / Ubuntu (APT)
sudo apt update && sudo apt install --only-upgrade firefox-esr thunderbird
firefox-esr --version            # confirm it maps to 140.7+ / 147+

# Fedora / RHEL family (DNF)
sudo dnf upgrade firefox thunderbird
firefox --version

# Snap or Flatpak builds update on their own channel:
sudo snap refresh firefox
flatpak update org.mozilla.firefox

One caveat specific to Linux packaging: the distro version string (for example 140.7.0esr-1ubuntu1) is not the same as Mozilla's release number, but it should embed it. If your distro has not yet shipped a build that maps to 140.7 / 147, you are still exposed , in that case fall back to Mozilla's own tarball or Flatpak rather than waiting. Restart the application after upgrading so the patched binary is the one actually running.

If you cannot patch immediately

There is no official configuration that fully removes the vulnerability, but you can shrink the attack surface while you schedule the update. Because the bug lives in WebGL, the most direct stopgap is to disable WebGL: in about:config, set webgl.disabled to true. That blocks pages from invoking the affected CanvasWebGL path at the cost of breaking sites that legitimately use 3D graphics, so treat it as temporary.

For Thunderbird specifically, keep remote content blocked in messages (the default), since that prevents a hostile email from silently pulling in attacker-controlled content. Neither of these is a substitute for the patch , they only reduce the window. Update to the fixed build as soon as your change process allows.

Confirm and close out

Re-open About Firefox / About Thunderbird (or about:support) on each machine and confirm the version is 147 or 140.7 or higher on its branch.
If you used the WebGL stopgap, revert webgl.disabled back to false once the patched build is confirmed, so legitimate sites work again.
In a managed fleet, pull a fresh version report from your endpoint tool and verify no machine is still on a pre-fix build. The earlier this page's stray "re-scan with Nmap" advice does not apply , there is no listening service to scan; the version number is the source of truth.
This is not a credential-theft-by-default bug and there is no confirmed exploitation, so wholesale credential rotation is not warranted. If a specific machine shows signs of compromise from another vector, handle that on its own merits.

Because the flaw needs user interaction and there is no public exploit, you do not need an incident-response posture for this CVE on its own. The realistic close-out is simply: confirm every Firefox, ESR, and Thunderbird build is at or above the fixed version, then move on.

How the boundary-condition bug leads to an escape

It helps to picture the layers. A web page hands WebGL a stream of draw commands and buffers , vertex data, texture dimensions, array indices. The CanvasWebGL code translates those into calls against the graphics stack. Each of those values has an implied range: an index must stay inside the array it points into, a length must not exceed the buffer that backs it. "Incorrect boundary conditions" means one of those checks is wrong , off by one, using the wrong comparison, or trusting a length the page supplied. CWE-119 and CWE-20 together describe that precisely: bad input validation (CWE-20) lets an out-of-range value through, and the out-of-bounds memory operation (CWE-119) is what happens next.

On its own, an out-of-bounds read or write inside the content process is bad but contained. What makes this a sandbox escape is where that memory corruption sits. The graphics path is one of the few places where the content sandbox has to talk to lower-level system resources, so a controllable memory error there can be leveraged to influence a more privileged context rather than just crashing the tab. That is why Mozilla rated it scope-changed (S:C) with high confidentiality and integrity impact: an attacker who pulls it off is no longer confined to the page they served.

The practical takeaway for defenders is that you cannot reason about this purely as "a graphics glitch." The component is graphics; the consequence is containment failure. That gap between symptom and impact is the whole reason browser vendors treat sandbox-escape reports as high severity even when, as here, the bug is hard to trigger and needs the user to walk into it.

Frequently asked questions

Is CVE-2026-0878 on the CISA KEV catalog or being exploited?

No. It is not on the CISA Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment records Exploitation as none. No public exploit is linked in Mozilla's advisories. It is still rated High (CVSS 8.0), so update on a normal prompt schedule rather than ignoring it.

Which versions fix CVE-2026-0878?

Mozilla fixed it in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. Any build at or above those versions on its branch is not affected.

Do I need to do anything if I only use Thunderbird, not Firefox?

Yes. Thunderbird shares Firefox's Gecko engine and the vulnerable CanvasWebGL graphics code, so Thunderbird 147 and 140.7 carry the same fix. Update Thunderbird even if you never run Firefox.

Can an attacker exploit this just by sending me an email or a link?

The flaw needs the victim to load attacker-controlled WebGL content, so user interaction is required (CVSS UI:R). Loading a malicious page in Firefox, or remote content in a Thunderbird message, is the realistic trigger. Keeping remote content blocked in Thunderbird reduces exposure until you patch.

References

Mozilla bug report: https://bugzilla.mozilla.org/show_bug.cgi?id=2003989
NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-0878
CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Mozilla advisory mfsa2026-01: https://www.mozilla.org/security/advisories/mfsa2026-01/
Mozilla advisory mfsa2026-03: https://www.mozilla.org/security/advisories/mfsa2026-03/
Mozilla advisory mfsa2026-04: https://www.mozilla.org/security/advisories/mfsa2026-04/
Mozilla advisory mfsa2026-05: https://www.mozilla.org/security/advisories/mfsa2026-05/

This guide was assembled from the official Mozilla advisories, the CVE record (CWE and CVSS data), and the CISA SSVC vulnrichment, and last reviewed on 2026-06-15. Always confirm against the vendor advisory before applying changes in production.

Other vulnerabilities worth patching alongside this one: