Cyber Posture

CVE-2026-2761

Critical

Published: 24 February 2026

Published
24 February 2026
Modified
13 April 2026
KEV Added
—
Patch
—
CVSS Score 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0014 34.4th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Sandbox escape in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly requires timely remediation of identified flaws through patching, as recommended for CVE-2026-2761 by updating to fixed Firefox and Thunderbird versions.

SI-5 Security Alerts, Advisories, and Directives good match
prevent

Mandates receiving and acting on vendor security advisories like Mozilla MFSA2026-13 through -16, enabling prompt updates to mitigate the WebRender sandbox escape.

RA-5 Vulnerability Monitoring and Scanning good match
prevent

Requires vulnerability scanning to identify systems running vulnerable Firefox or Thunderbird versions affected by CVE-2026-2761 for prioritized patching.

Security SummaryAI

CVE-2026-2761 is a sandbox escape vulnerability in the Graphics: WebRender component of Mozilla Firefox and Thunderbird. It affects these products in versions prior to the fixed releases: Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Published on 2026-02-24, the issue carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and is associated with CWEs NVD-CWE-noinfo and CWE-693.

The vulnerability can be exploited by remote attackers with network access, requiring low attack complexity, no privileges, and no user interaction. Exploitation changes scope and enables high-impact consequences across confidentiality, integrity, and availability, allowing attackers to escape the browser sandbox and potentially achieve arbitrary code execution or full system compromise.

Mozilla security advisories MFSA2026-13, MFSA2026-14, MFSA2026-15, and MFSA2026-16 detail the patches applied in the listed fixed versions. Mitigation requires updating affected Firefox and Thunderbird installations to these versions or later, as described in the advisories and the upstream Bugzilla entry at https://bugzilla.mozilla.org/show_bug.cgi?id=2011063.

Details

CWE(s)
NVD-CWE-noinfoCWE-693

Affected Products

mozilla
firefox
≤ 115.33.0 · ≤ 148.0 · 128.0 — 140.8.0
mozilla
thunderbird
≤ 140.8.0 · ≤ 148.0

MITRE ATT&CK Enterprise TechniquesAI

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
attack.mitre.org →
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
T1211 Exploitation for Stealth Stealth
Adversaries may exploit vulnerabilities to evade detection by hiding activity, suppressing logging, or operating within trusted or unmonitored components.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Remote sandbox escape in browser rendering engine enables drive-by compromise (T1189), client execution via vuln exploitation (T1203), defense evasion by bypassing sandbox (T1211), and privilege escalation from sandboxed context (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References