CVE-2026-2760
Mozilla Firefox ≤ 115.33.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-2760 is a critical-severity Improper Handling of Physical or Environmental Conditions (CWE-1384) vulnerability in Mozilla Firefox. Its CVSS base score is 10.0 (Critical).
Operationally, ranked at the 49th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CP-12 (Safe Mode) and PE-13 (Fire Protection) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-2760 is a sandbox escape vulnerability stemming from incorrect boundary conditions in the Graphics: WebRender component of Mozilla Firefox and Thunderbird. It affects versions of Firefox prior to 148, Firefox ESR prior to 115.33 and 140.8, Thunderbird prior to 148, and Thunderbird prior to 140.8. The issue is cataloged under CWE-1384 with an NVD-CWE-noinfo mapping and carries a maximum CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low attack complexity, and lack of prerequisites.
Remote attackers can exploit this vulnerability over the network without user privileges or interaction, leveraging malicious web content to bypass the browser's sandbox isolation in the WebRender graphics rendering engine. Successful exploitation enables scope change with high impacts on confidentiality, integrity, and availability, potentially granting attackers full control over the affected browser process and leading to arbitrary code execution on the user's system.
Mozilla's security advisories (MFSA 2026-13 through 2026-16) and the associated Bugzilla entry (bug 2011062) detail the fix applied in the specified versions of Firefox and Thunderbird. Security practitioners should prioritize updating affected browsers to mitigate this risk, as no workarounds are mentioned in the provided references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8482
Vulnerability Data
Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
EMP protection directly addresses an artificially induced physical/environmental threat.
Safe-mode entry on detected adverse conditions reduces impact without eliminating the root handling weakness.
Fire detection and suppression directly stops fire (an environmental condition) from damaging the system.
Maintaining temperature and humidity levels prevents environmental conditions from affecting system operation.
Isolation valves and shutoffs stop water damage (environmental condition) from reaching the system.
Known-state failure on component or environmental faults limits blast radius.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Ensures information security is maintained during physical or environmental disruptions.
ICT readiness for business continuity includes resilience to environmental conditions.
Physical perimeters reduce exposure to external environmental threats.
A.7.11's configuration, inspection, testing, alarms, redundancy, and isolation of supporting utilities directly stop most natural or induced physical/environmental failures from being exploited (e.g. power loss, HVAC failure, utility disruption), with a bounded remainder of non-utility physical conditions (e.g. temperature extremes, electromagnetic interference, or mechanical shock not tied to utilities).
Physical security monitoring can detect environmental anomalies or tampering.
Directly requires protection against physical and environmental threats that the weakness describes.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-1384, a class-level weakness, and none of its children carries one either.