External risk intelligence

Firefox and Thunderbird Graphics Sandbox Escape Use-After-Free

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-117985

This vulnerability affects web browsers (Firefox) and email clients (Thunderbird). While these applications interact with the internet, they are client-side software rather than network-accessible services, gateways, or internet-facing infrastructure. The vulnerable component requires local execution by a user, placing it outside the scope of publicly reachable attack surfaces.

Use After Free

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the graphics component of certain software, allowing for a sandbox escape. While patches are available, the main concern at this stage is to confirm if our organization's specific products and configurations are affected by this issue.

Allows attackers to break out of safe environments.
Critical flaw affects widely used web and email software.
Confirm relevance and exposure to understand potential impact.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious website or opening a specially crafted email. This would allow them to execute code within the application's sandbox, and if successful, escape the sandbox to gain broader access to the user's system.

Requires user interaction.
Triggers use-after-free in Graphics.
Allows sandbox escape.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in the Graphics component of affected applications could allow an attacker to escape the sandbox when a user interacts with specifically crafted content. This could potentially lead to the compromise of system data and service behavior.

Sandbox escape could affect system data.
Malicious content could trigger exposure.
Sensitive information may be compromised.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership for this vulnerability likely falls to teams managing end-user computing environments, including desktop or laptop management, and potentially application owners if specific instances are managed centrally. The first practical step is to identify all endpoints where the affected browser or email client is deployed, confirm if user interaction is required for exploitation, and then prioritize remediation based on user base and criticality.

Desktop and application teams own remediation.
Verify user exposure and affected installations.
Plan coordinated updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the software affected by CVE-2026-117985?

This vulnerability affects Firefox and Thunderbird. These are popular client-side applications used for browsing the web and managing email. The issue specifically resides within their graphics component, which handles rendering visual content like images and page layouts.

What does use-after-free mean in this CVE?

Use-after-free is a memory management error identified as CWE-416. It occurs when a program continues to use a memory location after it has been cleared or freed. In this case, an attacker can manipulate this flaw to bypass the browser's sandbox—the security boundary designed to keep malicious code from reaching your operating system.

How is this sandbox escape triggered?

An attacker must trick a user into interacting with malicious content, such as a specially crafted website or email. The bug does not trigger on its own; it requires the application to process that specific content. Simply having the software installed or running in the background without user interaction does not trigger the vulnerability.

Is my system at risk if I use Firefox or Thunderbird?

According to Halo Surface Signal, this vulnerability is classified as 'very unlikely' to be an internet-facing threat. Because Firefox and Thunderbird are client-side programs rather than public servers or infrastructure, they are not reachable by remote attackers over the network without a user actively engaging with malicious content.

What should I do to address this vulnerability?

The most effective response is to update your software. The vulnerability is resolved in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. Prioritize these updates for all endpoints where these applications are installed to ensure your security patches are current.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.