CVE-2026-100781

Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component

Published Sep 29, 2026 CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Description

Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Analysis

Technical impact

This vulnerability describes a sandbox escape in Mozilla’s Graphics: WebRender component caused by incorrect boundary checks. An attacker could trigger the flaw by supplying malicious graphic content, which would allow execution with the privileges of the browser process.

Affected Systems

All Firefox and Thunderbird users running versions earlier than Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, or Thunderbird 153.4 are affected. This includes every operating system supported by those releases.

Risk and Exploitability

Exploit would require loading crafted graphics into the browser; once triggered, the sandbox escape could lead to arbitrary code execution. The CVSS score of 9.6 reflects a critical severity, and the EPSS score of < 1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mozilla

Firefox

affected

Version	Status	Constraints
`115.42`	unaffected	≤ 115.*
`140.17`	unaffected	≤ 140.*
`153.4`	unaffected	≤ 153.*
`157`	unaffected	≤ *

Mozilla

Thunderbird

affected

Version	Status	Constraints
`140.17`	unaffected	≤ 140.*
`153.4`	unaffected	≤ 153.*
`157`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:a:mozilla:firefox:::::-:::*
	cpe:2.3:a:mozilla:firefox:::::esr:::*
	cpe:2.3:a:mozilla:firefox:::::esr:::*
	cpe:2.3:a:mozilla:firefox:::::esr:::*
	cpe:2.3:a:mozilla:thunderbird:::::-:::*
	cpe:2.3:a:mozilla:thunderbird:::::esr:::*
	cpe:2.3:a:mozilla:thunderbird:::::esr:::*

No data.

Vendor Product Versions

Mozilla

Firefox

Version	Status	Scheme	Platform
`[115.42,116.0.0)`	unaffected	generic	—
`[140.17,141.0.0)`	unaffected	generic	—
`[153.4,154.0.0)`	unaffected	generic	—
`[157,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to Firefox 157 or newer, or to any newer ESR release (115.42, 140.17, or 153.4).
If updating is not immediately possible, disable the WebRender engine by setting the preference dom.webrender.enabled to false in about:config.
Consider running Firefox inside a sandboxed container to contain any potential exploitation.

Generated by OpenCVE AI on October 1, 2026 at 18:11 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4810-1	thunderbird security update
Debian DLA	DLA-4814-1	firefox-esr security update
Debian DSA	DSA-6533-1	firefox-esr security update
Debian DSA	DSA-6536-1	thunderbird security update

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.328% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=2068434
https://www.mozilla.org/security/advisories/mfsa2026-100/
https://www.mozilla.org/security/advisories/mfsa2026-101/
https://www.mozilla.org/security/advisories/mfsa2026-102/
https://www.mozilla.org/security/advisories/mfsa2026-103/
https://www.mozilla.org/security/advisories/mfsa2026-97/
https://www.mozilla.org/security/advisories/mfsa2026-98/
https://www.mozilla.org/security/advisories/mfsa2026-99/

History

Oct 5, 2026 3:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mozilla thunderbird
CPEs		cpe:2.3:a:mozilla:firefox:::::-:::* cpe:2.3:a:mozilla:firefox:::::esr:::* cpe:2.3:a:mozilla:thunderbird:::::-:::* cpe:2.3:a:mozilla:thunderbird:::::esr:::*
Vendors & Products		Mozilla thunderbird

Oct 1, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Oct 1, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}`

Oct 1, 2026 4:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-119

Oct 1, 2026 2:45 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-787

Sep 30, 2026 5:45 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.	Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
References		https://www.mozilla.org/security/advisories/mfsa2026-102/ https://www.mozilla.org/security/advisories/mfsa2026-103/

Sep 30, 2026 5:30 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.	Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
References		https://www.mozilla.org/security/advisories/mfsa2026-101/

Sep 30, 2026 9:45 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-787

Sep 30, 2026 3:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-119

Sep 29, 2026 5:45 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-119

Sep 29, 2026 4:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla firefox
Vendors & Products		Mozilla Mozilla firefox

Sep 29, 2026 1:15 PM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description		Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Title		Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component
References		https://bugzilla.mozilla.org/show_bug.cgi?id=2068434 https://www.mozilla.org/security/advisories/mfsa2026-100/ https://www.mozilla.org/security/advisories/mfsa2026-97/ https://www.mozilla.org/security/advisories/mfsa2026-98/ https://www.mozilla.org/security/advisories/mfsa2026-99/