CVE-2026-117988 is a sandbox escape vulnerability caused by incorrect boundary conditions in the Graphics: CanvasWebGL component. This flaw allows an attacker to break out of the sandbox environment. The issue was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.