Mozilla -- Same-origin policy bypass in the Graphics: Canvas2D componententered 2025-11-02no CVE referenced