CVE-2026-2761

The vulnerability is located in the WebRender component responsible for graphics rendering. Its exploitation allows breaking through the process isolation mechanism (sandbox), which normally restricts the scope of code execution in a browser or mail client. The attack vector is network-based, requires no authentication or user interaction, and the scope of impact extends beyond the isolated component (Scope: Changed). Technical details of the vulnerability mechanism have not been disclosed.

An attacker can gain complete control over the victim's system, obtaining confidentiality, integrity, and availability at the highest level — corresponding to the ability to execute arbitrary code outside the sandbox environment. Successful exploitation of the vulnerability can lead to complete compromise of the operating system.

Software must be immediately updated to the following versions: Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, or Thunderbird 140.8. Details available in Mozilla security advisories: mfsa2026-13, mfsa2026-14, mfsa2026-15, mfsa2026-16.

Mozilla Firefox prior to version 148, Mozilla Firefox ESR prior to versions 115.33 and 140.8, Mozilla Thunderbird prior to version 148, and Mozilla Thunderbird prior to version 140.8.