Description
Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Published: 2026-02-24
Score: 10 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Sandbox Escape
Action: Immediate Patch
AI Analysis

Impact

This vulnerability allows an attacker to escape the sandbox enforced by the browser or email client through incorrect boundary checks in the WebRender graphics component.

Affected Systems

Mozilla Firefox and Mozilla Thunderbird are affected. The issue applies to all releases before Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8; versions at or beyond these patch levels contain the fix.

Risk and Exploitability

With a CVSS score of 10 the vulnerability is considered critical. The EPSS score indicates a very low exploitation probability. It is not yet present in CISA's KEV catalogue. The likely attack vector is remote, exploiting rendered web content from an untrusted source; the attacker would need to trick the rendering pipeline to access memory outside its bounds.

Generated by OpenCVE AI on April 15, 2026 at 16:13 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Mozilla Firefox to version 148 or newer, or to Firefox ESR 115.33 or 140.8.
  • Update Mozilla Thunderbird to version 148 or newer, or to Thunderbird ESR 140.8.
  • If an immediate upgrade is not feasible, disable WebRender or enforce stricter content isolation for untrusted content until the fix is applied.

Generated by OpenCVE AI on April 15, 2026 at 16:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4496-1 firefox-esr security update
Debian DSA Debian DSA DSA-6148-1 firefox-esr security update
References
Link Providers
https://access.redhat.com/errata/RHSA-2026:3338 cve-icon
https://access.redhat.com/errata/RHSA-2026:3339 cve-icon
https://access.redhat.com/errata/RHSA-2026:3361 cve-icon
https://access.redhat.com/errata/RHSA-2026:3491 cve-icon
https://access.redhat.com/errata/RHSA-2026:3492 cve-icon
https://access.redhat.com/errata/RHSA-2026:3493 cve-icon
https://access.redhat.com/errata/RHSA-2026:3494 cve-icon
https://access.redhat.com/errata/RHSA-2026:3495 cve-icon
https://access.redhat.com/errata/RHSA-2026:3496 cve-icon
https://access.redhat.com/errata/RHSA-2026:3497 cve-icon
https://access.redhat.com/errata/RHSA-2026:3515 cve-icon
https://access.redhat.com/errata/RHSA-2026:3516 cve-icon
https://access.redhat.com/errata/RHSA-2026:3517 cve-icon
https://access.redhat.com/errata/RHSA-2026:3976 cve-icon
https://access.redhat.com/errata/RHSA-2026:3978 cve-icon
https://access.redhat.com/errata/RHSA-2026:3979 cve-icon
https://access.redhat.com/errata/RHSA-2026:3980 cve-icon
https://access.redhat.com/errata/RHSA-2026:3981 cve-icon
https://access.redhat.com/errata/RHSA-2026:3982 cve-icon
https://access.redhat.com/errata/RHSA-2026:3983 cve-icon
https://access.redhat.com/errata/RHSA-2026:3984 cve-icon
https://access.redhat.com/errata/RHSA-2026:4022 cve-icon
https://access.redhat.com/errata/RHSA-2026:4152 cve-icon
https://access.redhat.com/errata/RHSA-2026:4260 cve-icon
https://access.redhat.com/errata/RHSA-2026:4432 cve-icon
https://access.redhat.com/security/cve/CVE-2026-2760 cve-icon
https://bugzilla.mozilla.org/show_bug.cgi?id=2011062 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2442325 cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-2760 cve-icon
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2760.json cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-2760 cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-13/ cve-icon cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-14/ cve-icon cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-15/ cve-icon cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2760 cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-16/ cve-icon cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-17/ cve-icon cve-icon
History

Mon, 13 Apr 2026 14:30:00 +0000

Type Values Removed Values Added
Description Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Sat, 28 Feb 2026 04:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 26 Feb 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1384

Wed, 25 Feb 2026 17:45:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 10.0, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}

Wed, 25 Feb 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Mozilla firefox Esr
Mozilla thunderbird
Vendors & Products Mozilla
Mozilla firefox
Mozilla firefox Esr
Mozilla thunderbird

Wed, 25 Feb 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Important

Tue, 24 Feb 2026 18:00:00 +0000

Type Values Removed Values Added
Description Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, and Firefox ESR < 140.8. Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
References

Tue, 24 Feb 2026 14:00:00 +0000

Type Values Removed Values Added
Description Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, and Firefox ESR < 140.8.
Title Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component
References

Subscriptions

Mozilla Firefox Firefox Esr Thunderbird
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-07-15T01:14:03.073Z

Reserved: 2026-02-19T15:05:23.107Z

Link: CVE-2026-2760

cve-icon Vulnrichment

Updated: 2026-02-26T15:50:49.982Z

cve-icon NVD

Status : Modified

Published: 2026-02-24T14:16:24.257

Modified: 2026-07-15T02:19:34.077

Link: CVE-2026-2760

cve-icon Redhat

Severity : Important

Publid Date: 2026-02-24T13:33:00Z

Links: CVE-2026-2760 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-15T17:15:10Z

Weaknesses