CVE-2026-4684 is a race condition and use-after-free vulnerability affecting the Graphics: WebRender component in Mozilla Firefox. It is classified under CWE-416 (Use After Free) and CWE-362 (Race Condition). The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with network attack vector, high attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. The issue was reported by Oskar L and fixed in Firefox 149 and Firefox ESR 115.34 and 140.9 releases, as well as corresponding Thunderbird versions. The vendor advisory confirms the fix and recommends updating to these versions to mitigate the risk.

Successful exploitation of this vulnerability could lead to arbitrary code execution due to memory corruption caused by a race condition and use-after-free in the WebRender graphics component. This could compromise confidentiality, integrity, and availability of the affected system. However, no active exploitation in the wild has been reported so far.

Mozilla has released official fixes for this vulnerability in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. Users and administrators should update to these versions or later to remediate the vulnerability. Since the vulnerability is patched, no additional mitigation steps are required beyond applying the official updates.