CVE-2026-4684 is a race condition and use-after-free vulnerability in the Graphics: WebRender component of Mozilla Firefox. This memory safety bug could allow an attacker to cause memory corruption, potentially leading to arbitrary code execution or other high-impact consequences. The issue was reported by Oskar L and fixed in Firefox 149, Firefox ESR 115.34, and Firefox ESR 140.9. The vulnerability has a CVSS 3.1 base score of 7.5, reflecting network attack vector, high attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. Mozilla's official security advisories confirm the fix and recommend updating to the patched versions.

The vulnerability allows an attacker to exploit a race condition and use-after-free in the WebRender graphics component, which can lead to memory corruption. This may result in arbitrary code execution, data disclosure, or denial of service, impacting confidentiality, integrity, and availability of the affected Firefox installations. The CVSS score of 7.5 indicates a high severity risk. There are no known exploits in the wild reported at the time of disclosure.

Mozilla has released official fixes for this vulnerability in Firefox 149, Firefox ESR 115.34, and Firefox ESR 140.9. Users and administrators should update affected Firefox and Thunderbird versions to these fixed releases to remediate the vulnerability. Since this is not a cloud service, patching the client software is required. No additional mitigation steps are indicated by the vendor advisory.