CVE-2026-0878

Public on 2026-01-13
Modified on 2026-01-15
Description
Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability affects Firefox < 147 and Firefox ESR < 140.7.
Severity
Important severity
Important
See what this means
CVSS v3 Base Score
7.5
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Firefox Extra firefox 2026-02-19 ALAS2FIREFOX-2026-050 Fixed
Amazon Linux 2023 firefox 2026-02-18 ALAS2023-2026-1429 Fixed
Amazon Linux 2 - Core thunderbird 2026-02-19 ALAS2-2026-3167 Fixed

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

FAQs regarding Amazon Linux ALAS/CVE Severity Red Hat: CVE-2026-0878 Mitre: CVE-2026-0878