CVE-2026-2761 is a critical flaw in Firefox and Thunderbird, scored 10.0 in the NVD record. It is a sandbox escape in the Graphics: WebRender component. Mozilla fixed it in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148 and Thunderbird 140.8. Update your browsers and mail clients to those releases or later.
What's affected
The record says this issue was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148 and Thunderbird 140.8. Anything older is affected. The advisories list fixes in Firefox ESR 115.33 as well as ESR 140.8.
For the upstream detail, Mozilla tracks it as Bug 2011063 and covers it in the security advisories for Firefox, Firefox ESR and Thunderbird.
Thunderbird needs a note. Mozilla says that, in general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but they are potentially risks in browser or browser like contexts. Update it anyway.
The Mozilla advisories rate the impact as high and name the Graphics: WebRender component. The record scores 10.0, which is critical, with a network attack vector and no privileges required. The CVSS vector marks scope as changed, which is why the score reaches 10.0. The record does not say this CVE is exploited, and the CISA KEV flag is false.
How to check if you're exposed
Check the version on every machine that runs Firefox or Thunderbird.
- In Firefox, open Help, then About Firefox. In Thunderbird, open Help, then About Thunderbird.
- From a shell, run
firefox --versionorthunderbird --version. - On Debian or Ubuntu use
dpkg-query -W firefox, on RPM systemsrpm -q firefox, and on Windowswinget list Mozilla.Firefox.
Compare the result against the fixed releases above. Remember kiosks, shared lab machines and virtual desktop images, which tend to lag behind. This is installed software and not an application dependency, so a dependency scan will not report it, but the Gold entry for the CVE lets you follow it.
What to do now
- Update Firefox to 148 or later, or Firefox ESR to 140.8 or 115.33 or later, on every managed device.
- Update Thunderbird to 148 or 140.8 or later.
- Restart the application, since the old build keeps running until you do.
- Check enterprise software deployment tools and package mirrors for the new versions.
- Keep automatic updates on for unmanaged users, and report machines that block them.
- Remove or isolate browsers that cannot be updated.
Why it matters
A browser runs web content in a restricted process, the sandbox, so a bug in content handling does not hand over the whole machine. A sandbox escape is a flaw that lets code get out of that restricted process. Here the Mozilla title is "Sandbox escape in the Graphics: WebRender component", and the record lists CWE-693.
Browsers parse and run untrusted content all day, which makes them a common first stop for attackers. A sandbox escape is a different job from a content bug. It works on a process that is already compromised and widens what it can reach, so it is most dangerous when paired with another flaw.
The practical advice is the same as always. Keep the update channel working and measure how quickly it reaches every device.
Quick check
Is a sandbox escape the same as remote code execution?
No. A sandbox escape lets code leave the restricted browser process. Mozilla lists it as its own flaw, and it matters most when combined with another bug. Update regardless.
Sources
- Mozilla Foundation Security Advisory 2026-13 (Firefox 148)
- Advisory 2026-14 (Firefox ESR 115.33)
- Advisory 2026-15 (Firefox ESR 140.8)
- Advisory 2026-16 (Thunderbird 148)
- Advisory 2026-17 (Thunderbird 140.8)
Last reviewed: 19 October 2026.
