A flaw in the Graphics: WebRender component lets a sandboxed script bypass its confinement, enabling an attacker to run code with the privileges of the host application. This memory‑corruption style vulnerability, designated as CWE‑693, can compromise system confidentiality, integrity, and availability.

Mozilla Firefox versions earlier than 148, Firefox ESR 115.33 and below, and Firefox ESR 140.8 and below, and Mozilla Thunderbird versions earlier than 148, Thunderbird ESR 140.8 and below, are vulnerable. All later releases include the fix.

The CVSS score of 10 classifies it as critical, while the EPSS score of less than 1% indicates rare current exploitation but still possible. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is the delivery of malicious content that forces WebRender to process crafted graphics data, which could be triggered by visiting an infected webpage or opening a phishing email attachment. Because the flaw allows arbitrary code execution, the impact could be full system compromise.