CVE-2026-2761 is a sandbox escape vulnerability in the Graphics: WebRender component of Mozilla Firefox. The flaw allows an attacker to break out of the sandbox containment, which is designed to isolate potentially malicious code and limit its impact. This vulnerability was reported by Oskar L and fixed in Firefox 148 and Firefox ESR 115.33. The vulnerability has a CVSS 3.1 base score of 10.0, reflecting its critical nature and the potential for complete system compromise without requiring privileges or user interaction. The Mozilla Foundation released official security advisories MFSA 2026-13 and MFSA 2026-14 detailing the fix and impact. The affected versions are all Firefox versions prior to 148 and Firefox ESR versions prior to 115.33.

Successful exploitation of this vulnerability allows an attacker to escape the sandbox environment in Firefox's WebRender graphics component. This can lead to arbitrary code execution with the privileges of the user running Firefox, potentially resulting in full system compromise. The vulnerability has a critical CVSS score of 10.0, indicating high impact on confidentiality, integrity, and availability.

Mozilla has released official fixes for this vulnerability in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Users and administrators should update affected products to these versions or later to remediate the vulnerability. No additional mitigations are required once the update is applied.