CVE-2026-100832: Use-after-free in the Graphics: Canvas2D component

Published Sep 29, 2026

Updated

Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Firefox ESR 115.42, and Firefox ESR 140.17.

Affected Software

3 affected componentsFixes available

Mozilla Firefox ESR<115.42

115.42

Mozilla Firefox ESR<140.17

140.17

Mozilla Firefox ESR<153.4

153.4

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 115.42
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 140.17
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 153.4
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 153.4
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 115.42
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 140.17

Sep 29, 2026

CVE Published

via Mozilla·12:00 AM

Data Sourced

via Mozilla·12:00 AM

DescriptionSeverityAffected Software

Updated

via Mozilla·12:00 AM

Affected Software

CVE Published

via MITRE·12:36 PM

Data Sourced

via MITRE·12:36 PM

Description

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

This vulnerability appears in the following advisories.

Found alongside the following vulnerabilities.