CVE-2026-74934: Site isolation issue in the Graphics: CanvasWebGL component
Site isolation issue in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 140.14 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 154 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 115.39 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 153.1 - Upgrade
Upgrade
Mozilla Firefoxto a version that resolves this vulnerability.Fixed in 154 - Upgrade
Upgrade
Mozilla Firefox ESRto a version that resolves this vulnerability.Fixed in 115.39 - Upgrade
Upgrade
Mozilla Firefox ESRto a version that resolves this vulnerability.Fixed in 140.14 - Upgrade
Upgrade
Mozilla Firefox ESRto a version that resolves this vulnerability.Fixed in 153.1 - Upgrade
Upgrade
Mozilla Thunderbirdto a version that resolves this vulnerability.Fixed in 154 - Upgrade
Upgrade
Mozilla Thunderbirdto a version that resolves this vulnerability.Fixed in 140.14 - Upgrade
Upgrade
Mozilla Thunderbirdto a version that resolves this vulnerability.Fixed in 153.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-74934
- CVE-2026-74935
- CVE-2026-74936
- CVE-2026-74939
- CVE-2026-74940
- CVE-2026-74941
- CVE-2026-74942
- CVE-2026-74943
- CVE-2026-74944
- CVE-2026-74945
- CVE-2026-74946
- CVE-2026-74948
- CVE-2026-74949
- CVE-2026-74953
- CVE-2026-74957
- CVE-2026-74959
- CVE-2026-74960
- CVE-2026-74962
- CVE-2026-74963
- CVE-2026-74964
- CVE-2026-74965
- CVE-2026-74967
- CVE-2026-74969
- CVE-2026-74971
- CVE-2026-74972
- CVE-2026-74973
- CVE-2026-74974
- CVE-2026-74976
- CVE-2026-74983
- CVE-2026-74987
- CVE-2026-74990
- CVE-2026-75874
- CVE-2026-74937
- CVE-2026-74938
- CVE-2026-74947
- CVE-2026-74950
- CVE-2026-74951
- CVE-2026-74952
- CVE-2026-74954
- CVE-2026-74955
- CVE-2026-74956
- CVE-2026-74958
- CVE-2026-74961
- CVE-2026-74966
- CVE-2026-74968
- CVE-2026-74970
- CVE-2026-74975
- CVE-2026-74977
- CVE-2026-74978
- CVE-2026-74979
- CVE-2026-74980
- CVE-2026-74981
- CVE-2026-74982
- CVE-2026-74984
- CVE-2026-74985
- CVE-2026-74986
- CVE-2026-74988
- CVE-2026-74989
- CVE-2026-84637
Frequently Asked Questions
Which releases contain the fix?
The issue is fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, and Firefox ESR 153.1. Deploy the applicable fixed release for the Firefox or Firefox ESR branch in use.
What is known about exposure and mitigation before an update is installed?
The affected component is Graphics: CanvasWebGL, and the issue concerns site isolation. The provided information does not specify exploit prerequisites, affected default settings, mitigations short of updating, or detection methods.