CVE-2026-2760

The vulnerability results from incorrect boundary conditions in the Graphics: WebRender component. Faulty boundary verification allows an attacker to break sandbox isolation, which normally restricts code executed in the context of the browser or mail client. The attack can be conducted remotely, without authentication and without user interaction, making it particularly dangerous.

An attacker can escape the sandbox environment and gain unauthorized access to the host operating system, potentially taking full control over the confidentiality, integrity, and availability of system resources.

Update to Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, or Thunderbird 140.8, in which the vulnerability has been fixed. Detailed information available in Mozilla security advisories: mfsa2026-13, mfsa2026-14, mfsa2026-15, mfsa2026-16.

Mozilla Firefox in versions before 148 and Firefox ESR in versions before 115.33 and before 140.8; Mozilla Thunderbird in versions before 148 and before 140.8.