CVE-2026-2761
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
A sandbox escape vulnerability exists in the Graphics: WebRender component of Firefox and Thunderbird. The flaw was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Risk Assessment
An attacker could exploit this vulnerability to break out of the browser sandbox and gain access to the underlying operating system, potentially leading to full system compromise or data theft.
Recommendation
Immediately update Firefox and Thunderbird to the patched versions listed (Firefox 148, ESR 115.33/140.8, Thunderbird 148/140.8).
Original NVD description (English source)
Sandbox escape in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.