CVE-2026-2760 is a sandbox escape vulnerability caused by incorrect boundary conditions in the Graphics: WebRender component of Mozilla Firefox. This flaw could allow an attacker to break out of the browser's sandbox environment, potentially leading to arbitrary code execution with elevated privileges. The vulnerability is rated critical with a CVSS 3.1 base score of 10.0, reflecting its high impact and ease of exploitation. Mozilla addressed this issue in Firefox 148 and corresponding ESR and Thunderbird versions. The fix involves correcting the boundary condition checks in the WebRender component to prevent sandbox escape.

Successful exploitation of this vulnerability could allow an attacker to escape the browser sandbox, leading to full compromise of the affected system's confidentiality, integrity, and availability. Given the critical CVSS score of 10.0, the impact includes potential arbitrary code execution without any required privileges or user interaction. This represents a severe security risk for users running vulnerable versions of Firefox or Thunderbird.

Mozilla has released official fixes for this vulnerability in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Users and administrators should promptly update to these fixed versions to mitigate the risk. No additional mitigation steps are required beyond applying the official patches as per the vendor advisory.