CVE-2026-4684 describes a race condition and use-after-free vulnerability in the Graphics: WebRender component of Mozilla Firefox and Thunderbird. This memory safety issue could lead to high impact on confidentiality, integrity, and availability as indicated by the CVSS 3.1 base score of 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). The vulnerability was addressed and fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. Red Hat Enterprise Linux 8.6 distributions that bundle Firefox are affected, and Red Hat has released security updates to remediate this issue as detailed in advisory RHSA-2026:7842.

Successful exploitation of this vulnerability could result in memory corruption leading to potential arbitrary code execution or denial of service, impacting confidentiality, integrity, and availability of the affected systems. The CVSS score of 7.5 reflects a high severity with network attack vector, requiring user interaction and high attack complexity. The vulnerability affects Firefox and Thunderbird components included in Red Hat Enterprise Linux 8.6 variants.

A security update fixing this vulnerability is available from Red Hat as part of their advisory RHSA-2026:7842. Users and administrators should apply the updated Firefox packages included in this advisory to remediate the issue. The fixed versions include Firefox 149, Firefox ESR 115.34, and Firefox ESR 140.9. No additional mitigation steps are required beyond applying the official patches.