Skip to main content

Firefox Esr CVE-2026-4684

| EUVDEUVD-2026-14792 HIGH
Race Condition (CWE-362)
2026-03-24 mozilla GHSA-3rrq-fwhx-9wq4
Information Disclosure Race Condition Mozilla Firefox Esr
7.5
CVSS 3.1 · Vendor: mozilla
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    User visits malicious webpage
  2. Delivery
    Browser renders WebRender graphics component
  3. Exploit
    Race condition triggers use-after-free
  4. Execution
    Memory corruption occurs
  5. Impact
    Arbitrary code executes with browser privileges

Vulnerability Assessment

Weakness
CWE
CWE-362
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK

1 technique across 1 tactic: Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The victim must open or view crafted web content in Firefox < 149, Firefox ESR < 115.34, or Firefox ESR < 140.9. Requires race condition timing on WebRender graphics component. Remote unauthenticated attacker via malicious webpage.
Impact

Without published CVSS scores, EPSS data, or CWE classifications in the advisory materials, the risk assessment relies on structural indicators. The vulnerability affects a core graphics rendering component used by all Firefox installations, suggesting broad exposure. Race conditions and use-after-free bugs typically have moderate attack complexity (requiring specific timing or conditions) but can result in memory corruption leading to code execution or information disclosure. The fact that Mozilla released security advisories across three separate branches (MFSA2026-20, MFSA2026-21, MFSA2026-22) indicates this was treated as a significant security issue warranting coordinated disclosure. However, without evidence of public exploitation or POC availability, this appears to be a proactive patch rather than a response to active attacks. Organizations should prioritize patching based on their user base size and the criticality of Firefox in their environment, but this is not an emergency zero-day scenario.
Exploit ScenarioDerived

An attacker could host a specially crafted web page containing graphics content (CSS animations, WebGL, or SVG) that triggers a race condition in WebRender's rendering pipeline. When a victim visits this page, the timing of concurrent rendering threads could cause one thread to access memory already freed by another, potentially leaking sensitive data from memory or causing a crash that could be chained into code execution. The attack requires no user interaction beyond visiting a malicious website and has a network-based attack vector, though the race condition timing makes reliable exploitation challenging.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 24, 2026

Mozilla Firefox's WebRender graphics component contains a race condition and use-after-free vulnerability that enables remote code execution when a user visits a malicious webpage. The flaw affects Firefox versions prior to 149, Firefox ESR versions before 115.34 and 140.9, and requires user interaction to trigger. No patch is currently available for this high-severity issue.

Earlier versions of this analysis (1)
v1 Mar 24, 2026 - 12:45 CVSS 7.5

A race condition and use-after-free vulnerability exists in Firefox's WebRender graphics component, affecting Firefox versions prior to 149, Firefox ESR prior to 115.34, and Firefox ESR prior to 140.9. This vulnerability could potentially lead to information disclosure or memory corruption when the renderer processes graphics operations concurrently. While no public exploit code or active exploitation has been confirmed, the vulnerability affects millions of Firefox users across multiple ESR branches and requires immediate patching.

RemediationAI

Immediately upgrade to Firefox version 149 or later for users on the mainline branch, Firefox ESR version 115.34 or later for the ESR 115 branch, or Firefox ESR version 140.9 or later for the ESR 140 branch. Most users have automatic updates enabled and will receive these fixes automatically; administrators managing Firefox deployments should verify completion of updates through browser version checks or MDM/device management platforms. Organizations unable to patch immediately should consider restricting Firefox usage to low-risk activities and disabling WebRender hardware acceleration if technically feasible (via about:config setting gfx.webrender.enabled to false), though this may impact performance. See https://www.mozilla.org/security/advisories/mfsa2026-20/, https://www.mozilla.org/security/advisories/mfsa2026-21/, and https://www.mozilla.org/security/advisories/mfsa2026-22/ for detailed patching instructions by ESR branch.

Affected VersionsENISA

Firefox ESR unspecified <115.34
Firefox ESR unspecified <140.9
Firefox unspecified <149

Affected Packages

euvd firefox_esr_unspecified fix: 115.34, 140.9
euvd firefox_unspecified fix: 149

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

WebRender is Mozilla's GPU-accelerated rendering engine used in Firefox to handle graphics composition and display. The vulnerability is classified as a race condition combined with use-after-free (CWE categories related to concurrency and memory safety), indicating that improper synchronization during parallel rendering operations allows a thread to access memory that has already been freed. This occurs within the graphics rendering pipeline where multiple threads may be accessing the same data structures without adequate locking mechanisms. The affected products span multiple Firefox branches: the mainline Firefox (cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*) and two Extended Support Release tracks—Firefox ESR 115.x and Firefox ESR 140.x—each with their own maintenance timelines.

Know when Firefox Esr gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mozilla) PRIMARY 7.5 HIGH
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (mozilla).

CVSS VectorVendor: mozilla

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Mar 24, 2026 - 12:30 nvd
HIGH 7.5

DescriptionCVE.org

Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.

Executive ViewAI

Why It Matters

CVE-2026-4684 presents notable security risk, a race condition vulnerability rated CVSS 7.5. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and consider compensating controls in the interim.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

EPSS Score
0.0%
Top 98% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Race Condition MEDIUM

Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).

Related Vulnerabilities in Firefox Multiple Component Vulnerabilities

View all 15
CVE-2026-4716 CRITICAL
9.1
CVE-2026-4725 CRITICAL
10.0
CVE-2026-4727 HIGH
7.5
CVE-2026-4728 MEDIUM
6.5
CVE-2026-4692 CRITICAL POC
10.0
CVE-2026-4685 HIGH
7.5
CVE-2026-4686 HIGH
7.5
CVE-2026-4687 HIGH
8.6
CVE-2026-4688 CRITICAL
10.0
CVE-2026-4690 HIGH
8.6
CVE-2026-4691 CRITICAL
9.8
CVE-2026-4694 HIGH
7.5
CVE-2026-4705 CRITICAL
9.8
CVE-2026-4724 CRITICAL
9.1

More in Firefox Esr

View all
CVE-2015-4000 LOW POC
3.7 May 21

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not pro
CVE-2020-26950 HIGH POC
8.8 Dec 09

In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable

CVE-2026-4689 CRITICAL POC
10.0 Mar 24

A sandbox escape vulnerability exists in Firefox's XPCOM component due to incorrect boundary conditions and integer over
CVE-2022-29917 CRITICAL POC
9.8 Dec 22

Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bug
CVE-2014-1568 HIGH
7.5 Sep 25

Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozi
CVE-2022-26384 CRITICAL POC
9.6 Dec 22

If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scri
CVE-2022-34484 HIGH POC
8.8 Dec 22

The Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10. Rated high severity (CVSS 8.8)
CVE-2022-28281 HIGH POC
8.8 Dec 22

If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent pr
CVE-2022-26381 HIGH POC
8.8 Dec 22

An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially exploi
CVE-2022-22756 HIGH POC
8.8 Dec 22

If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been
CVE-2022-22740 HIGH POC
8.8 Dec 22

Certain network request objects were freed too early when releasing a network request handle. Rated high severity (CVSS

CVE-2022-22738 HIGH POC
8.8 Dec 22

Applying a CSS filter effect could have accessed out of bounds memory. Rated high severity (CVSS 8.8), this vulnerabilit

Same weakness CWE-362 – Race Condition

View all
CVE-2023-36884 HIGH POC
7.5
CVE-2016-5195 HIGH POC
7.0
CVE-2017-1000112 HIGH POC
7.0
CVE-2014-0196 MEDIUM POC
5.5
CVE-2014-0226 MEDIUM POC
6.8
CVE-2016-1757 HIGH POC
7.0
CVE-2016-8655 HIGH POC
7.8
CVE-2025-39964 MEDIUM POC
5.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

Debian

firefox
Release Status Fixed Version Urgency
sid vulnerable 148.0.2-1 -
(unstable) fixed (unfixed) -
firefox-esr
Release Status Fixed Version Urgency
bullseye vulnerable 115.14.0esr-1~deb11u1 -
bullseye (security) vulnerable 140.8.0esr-1~deb11u1 -
bookworm vulnerable 128.14.0esr-1~deb12u1 -
bookworm (security) vulnerable 140.8.0esr-1~deb12u1 -
trixie (security), trixie vulnerable 140.8.0esr-1~deb13u1 -
forky, sid vulnerable 140.8.0esr-1 -
(unstable) fixed (unfixed) -

SUSE

Severity: High
Product Status
Image SLES15-SP5-SAP-Azure-LI-BYOS Image SLES15-SP5-SAP-Azure-LI-BYOS-Production Image SLES15-SP5-SAP-Azure-VLI-BYOS Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production Image SLES15-SP6-SAP-Azure-LI-BYOS Image SLES15-SP6-SAP-Azure-LI-BYOS-Production Image SLES15-SP6-SAP-Azure-VLI-BYOS Image SLES15-SP6-SAP-Azure-VLI-BYOS-Production Image SLES15-SP7-SAP-Azure-LI-BYOS-Production Image SLES15-SP7-SAP-Azure-VLI-BYOS-Production Affected
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:5930 ADVISORY https://access.redhat.com/errata/RHSA-2026:5931 ADVISORY https://access.redhat.com/errata/RHSA-2026:5932 ADVISORY https://access.redhat.com/errata/RHSA-2026:6188 ADVISORY https://access.redhat.com/errata/RHSA-2026:6342 ADVISORY https://access.redhat.com/errata/RHSA-2026:6917 ADVISORY https://access.redhat.com/errata/RHSA-2026:7837 ADVISORY https://access.redhat.com/errata/RHSA-2026:7838 ADVISORY https://access.redhat.com/errata/RHSA-2026:7839 ADVISORY https://access.redhat.com/errata/RHSA-2026:7840 ADVISORY https://access.redhat.com/errata/RHSA-2026:7841 ADVISORY https://access.redhat.com/errata/RHSA-2026:7842 ADVISORY https://access.redhat.com/errata/RHSA-2026:7843 ADVISORY https://access.redhat.com/errata/RHSA-2026:7845 ADVISORY https://access.redhat.com/errata/RHSA-2026:7858 ADVISORY https://access.redhat.com/errata/RHSA-2026:8284 ADVISORY https://access.redhat.com/errata/RHSA-2026:8285 ADVISORY https://access.redhat.com/errata/RHSA-2026:8286 ADVISORY https://access.redhat.com/errata/RHSA-2026:8287 ADVISORY https://access.redhat.com/errata/RHSA-2026:8288 ADVISORY https://access.redhat.com/errata/RHSA-2026:8289 ADVISORY https://access.redhat.com/errata/RHSA-2026:8290 ADVISORY https://access.redhat.com/errata/RHSA-2026:8315 ADVISORY https://access.redhat.com/errata/RHSA-2026:8427 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-4684 ADVISORY https://vuldb.com/?id.352732 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1126/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1127/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1163/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20978/ REF https://access.redhat.com/errata/RHSA-2026:8850 REF https://access.redhat.com/security/cve/CVE-2026-4684 REF https://bugzilla.mozilla.org/show_bug.cgi?id=2011129 REF https://bugzilla.redhat.com/show_bug.cgi?id=2450721 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4684.json REF https://www.mozilla.org/security/advisories/mfsa2026-20/ REF https://www.mozilla.org/security/advisories/mfsa2026-21/ REF https://www.mozilla.org/security/advisories/mfsa2026-22/ REF https://www.mozilla.org/security/advisories/mfsa2026-23/ REF https://www.mozilla.org/security/advisories/mfsa2026-24/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy