EUVD-2026-88933
GHSA-4ghr-4mcr-5x55
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure user to malicious web page
-
DeliveryDeliver crafted WebRender graphics content
-
ExploitTrigger incorrect boundary condition (buffer overflow)
-
ExecutionEscape content sandbox (scope change)
-
ImpactExecute code in host context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim using an unpatched Firefox/Firefox ESR build to load attacker-controlled web content that exercises the Graphics: WebRender rendering path (PR:N, UI:R) - there is no authentication requirement but mandatory user interaction (visiting or rendering the malicious page). As a sandbox escape, realistic exploitation also presupposes the attacker can execute within or influence the content process, so it is typically chained rather than a standalone single-request compromise; this chaining need plus UI:R and the lack of automatability (SSVC 'no') materially limit mass exploitation despite the network attack vector. Fixed builds (Firefox 157, ESR 153.4, ESR 140.17, ESR 115.42) are not affected. |
| Impact | Signals are sharply split. The CVSS 3.1 vector (9.6, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) rates this Critical: a network-reachable, low-complexity sandbox escape requiring no privileges, only that a user open malicious web content, with a scope change and total CIA impact - consistent with CISA SSVC's 'Technical Impact: total'. Against that, forward-looking exploitation signals are low: EPSS is 0.16% (4th percentile), SSVC marks Exploitation 'none' and Automatable 'no', the CVE is not in CISA KEV, and no public exploit is referenced. The automatable='no' rating and UI:R requirement are consistent - a sandbox escape of this type typically must be chained with a separate content-process compromise and a user action, so it is not a wormable one-shot. Net: a genuinely severe memory-safety defect whose real-world near-term risk is moderated by the need for chaining and user interaction and the absence of any observed exploitation. Prioritize patching (browser, broad attack surface) but there is no evidence of active or imminent mass exploitation. Note the UI:R/scope-change profile means severity is driven by impact, not by ease of standalone exploitation. |
| Exploit ScenarioDerived | An attacker hosts or injects a malicious web page that triggers the WebRender boundary-condition flaw when a Firefox user visits it; combined with a content-process foothold, the bug lets code cross the browser sandbox boundary (S:C) and run with the privileges of the host process. No public exploit is identified at time of analysis, and user interaction (loading the page) is required, so delivery depends on phishing or a compromised/malvertising site. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
A sandbox escape in Mozilla Firefox's Graphics: WebRender component lets attacker-controlled web content break out of the browser's content-process sandbox and reach the parent/broker process, with a 9.6 CVSS score driven by scope change plus high confidentiality, integrity and availability impact. Successfully triggering it requires an unpatched build and mandatory user interaction (PR:N, UI:R) - the victim must load or render a malicious page that exercises the WebRender path - and because the flaw sits in the rendering/sandbox boundary rather than in a directly reachable network service, realistic abuse typically depends on chaining it with a separate content-process compromise, which is consistent with SSVC rating Exploitation 'none' and Automatable 'no'. Fixed builds are Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17 and Firefox ESR 115.42; there is currently no public exploit identified at time of analysis and EPSS is low at 0.16% (4th percentile), so exploitation signals are sharply split between the very high severity rating and the low likelihood evidence.
RemediationAI
Apply the vendor-released patch by upgrading to a fixed build: Firefox 157 on the main channel, or Firefox ESR 153.4, Firefox ESR 140.17, or Firefox ESR 115.42 for ESR deployments - ESR 115 users in particular must move to ESR 115.42 rather than assume extended support already covers the flaw. Mozilla's advisories (mfsa2026-97 through mfsa2026-103, e.g. https://www.mozilla.org/security/advisories/mfsa2026-100/) and the Bugzilla record at https://bugzilla.mozilla.org/show_bug.cgi?id=2068434 provide the authoritative fix detail, and enterprise fleets should confirm the exact build number rather than relying on channel auto-update alone. Because the flaw is reachable only through the Graphics: WebRender rendering path, interim compensating controls for systems that cannot be patched immediately include disabling hardware/WebRender acceleration (for example the gfx.webrender-related about:config preferences, which also disables GPU compositing and degrades rendering performance on complex pages) and reducing exposure by confining browsing to a hardened or virtualized profile and avoiding untrusted web content - but these are unconfirmed, potentially incomplete workarounds rather than vendor-endorsed fixes and should be treated as temporary. Note that there is no public exploit identified at time of analysis and EPSS is only 0.16%, so aggressive emergency change windows are not clearly warranted, though the 9.6 severity and S:C sandbox-escape characteristics justify high-priority patching within normal critical-update timelines.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WebRender is Mozilla's GPU-accelerated 2D rendering engine, written largely in Rust, that composites web content for Firefox's Graphics stack; it runs inside the sandboxed content process, which is separated from the privileged parent process by Firefox's multi-process (e10s/Fission) security architecture. The root cause is classified as CWE-119 (improper restriction of operations within the bounds of a memory buffer), tagged here as a buffer overflow arising from incorrect boundary conditions in the Graphics: WebRender component - i.e., a validation or size/limit check in the WebRender code path is wrong, so crafted rendering input can corrupt memory outside the intended buffer. In a normal renderer bug that corruption would be contained inside the content sandbox; here the incorrect boundary handling additionally crosses a sandbox boundary, which is why the CVSS vector carries S:C (scope changed) alongside C:H/I:H/A:H - compromise of the renderer is no longer contained and can reach a higher-privileged process. The CPE string cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* identifies the Mozilla Firefox product family (main and ESR channels) as affected across the version range preceding the fixed releases; the referenced Mozilla Bugzilla entry (bug 2068434) and the mfsa2026-97 through mfsa2026-103 advisories document the underlying defect and its fixes.
Know when Firefox gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-delivered web content with no privileges but required user interaction (UI:R); sandbox escape crosses a security boundary (S:C) with full code-execution impact, so C/I/A:H.
Primary rating from Vendor (mozilla).
CVSS VectorVendor: mozilla
Lifecycle Timeline
3DescriptionCVE.org
Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Executive ViewAI
Mozilla Firefox contains a critical sandbox-escape flaw in its WebRender graphics component that allows malicious web content to break out of the browser's content-process sandbox and reach the privileged parent process, exposing affected endpoints to full loss of confidentiality, integrity, and availability. Any employee browsing the web with an unpatched Firefox or Firefox ESR build is in scope, making this a whole-workforce endpoint exposure rather than an isolated server issue. Leadership should care because this vulnerability defeats the containment boundary that normally limits browser compromise to a single tab, and fixed builds are already specified by the vendor, so the exposure window is entirely a function of how quickly the browser fleet is updated.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for
Exploit-DB