CVE-2026-2761
Mozilla Firefox ≤ 115.33.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-2761 is a critical-severity Protection Mechanism Failure (CWE-693) vulnerability in Mozilla Firefox. Its CVSS base score is 10.0 (Critical).
Operationally, ranked at the 49th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-2761 is a sandbox escape vulnerability in the Graphics: WebRender component of Mozilla Firefox and Thunderbird. It affects these products in versions prior to the fixed releases: Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Published on 2026-02-24, the issue carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and is associated with CWEs NVD-CWE-noinfo and CWE-693.
The vulnerability can be exploited by remote attackers with network access, requiring low attack complexity, no privileges, and no user interaction. Exploitation changes scope and enables high-impact consequences across confidentiality, integrity, and availability, allowing attackers to escape the browser sandbox and potentially achieve arbitrary code execution or full system compromise.
Mozilla security advisories MFSA2026-13, MFSA2026-14, MFSA2026-15, and MFSA2026-16 detail the patches applied in the listed fixed versions. Mitigation requires updating affected Firefox and Thunderbird installations to these versions or later, as described in the advisories and the upstream Bugzilla entry at https://bugzilla.mozilla.org/show_bug.cgi?id=2011063.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8483
Vulnerability Data
Sandbox escape in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 directly requires enforcement of access authorizations via the protection mechanism itself.
AC-4 mandates use of information flow enforcement mechanisms to control data movement.
SC-2 requires separation of user and system functionality as a protection mechanism.
SC-28 requires protection mechanisms for information at rest.
SC-3 requires isolation of security functions from non-security functions.
SC-7 requires boundary protection mechanisms to monitor and control external communications.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Systematic verification that security mechanisms operate according to defined standards reduces the likelihood that protection mechanisms are bypassed or disabled.
A.8.26 only requires that security requirements (including protection mechanisms) be identified and specified during development or acquisition; it does not itself mandate, implement, or enforce the mechanisms that would remove CWE-693 instances from the product.
A.8.28 mandates secure coding practices, principles, standards, design, peer review, defect removal, prohibition of insecure techniques (e.g. hard-coded passwords), and evaluation of common errors before deployment, which directly removes many instances of missing or incorrectly used protection mechanisms from first-party code; the bounded remainder is third-party components and post-deployment issues handled by other clauses (8.8, 8.29).
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.