This vulnerability, identified as CVE-2026-92013, involves privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component of mozjs52. The issue was addressed and fixed in Firefox 156 and corresponding ESR and Thunderbird versions. The CVSS v3.1 score is 8.8, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. The vendor advisory from Mozilla confirms the fix and provides references to the bug report 2058078. Numerous specific vulnerable versions are listed, reflecting affected builds primarily in Ubuntu distributions.

Successful exploitation of this vulnerability could allow an attacker to escalate privileges, potentially gaining higher-level access than intended. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability. However, there are no reports of known exploits in the wild at this time.

A fix is available and has been released in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. Users and administrators should update to these fixed versions or later to mitigate this vulnerability. Refer to the Mozilla advisory at https://www.mozilla.org/en-US/security/advisories/mfsa2026-90/#CVE-2026-92013 for official guidance.