CVE-2026-2761

CriticalCVSS 10.0

Published: 24/02/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

32th percentile - higher than 32% of all known CVEs

Summary

A sandbox escape vulnerability exists in the Graphics: WebRender component of Firefox and Thunderbird. The flaw is fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Risk Assessment

An attacker can exploit this vulnerability to break out of the browser sandbox, potentially gaining full control over the underlying operating system and accessing sensitive organizational data.

Recommendation

Immediately update all Firefox and Thunderbird installations to the patched versions (Firefox 148, ESR 115.33/140.8, Thunderbird 148/140.8). Prioritize systems handling sensitive data.

Original NVD description (English source)

Sandbox escape in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.