CVE-2026-2761
Published: 24 February 2026
Summary
CVE-2026-2761 is a critical-severity Protection Mechanism Failure (CWE-693) vulnerability in Mozilla Firefox. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 31.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-2761 is a sandbox escape vulnerability in the Graphics: WebRender component of Mozilla Firefox and Thunderbird. It affects these products in versions prior to the fixed releases: Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Published on 2026-02-24, the issue carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and is associated with CWEs NVD-CWE-noinfo and CWE-693.
The vulnerability can be exploited by remote attackers with network access, requiring low attack complexity, no privileges, and no user interaction. Exploitation changes scope and enables high-impact consequences across confidentiality, integrity, and availability, allowing attackers to escape the browser sandbox and potentially achieve arbitrary code execution or full system compromise.
Mozilla security advisories MFSA2026-13, MFSA2026-14, MFSA2026-15, and MFSA2026-16 detail the patches applied in the listed fixed versions. Mitigation requires updating affected Firefox and Thunderbird installations to these versions or later, as described in the advisories and the upstream Bugzilla entry at https://bugzilla.mozilla.org/show_bug.cgi?id=2011063.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8483
Vulnerability details
Sandbox escape in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote sandbox escape in browser rendering engine enables drive-by compromise (T1189), client execution via vuln exploitation (T1203), defense evasion by bypassing sandbox (T1211), and privilege escalation from sandboxed context (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely remediation of identified flaws through patching, as recommended for CVE-2026-2761 by updating to fixed Firefox and Thunderbird versions.
Mandates receiving and acting on vendor security advisories like Mozilla MFSA2026-13 through -16, enabling prompt updates to mitigate the WebRender sandbox escape.
Requires vulnerability scanning to identify systems running vulnerable Firefox or Thunderbird versions affected by CVE-2026-2761 for prioritized patching.
Hardening callouts derived
Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).
Oracle Linux 8 (2 rules)
- V-248524 OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. via CWE-693
- V-248525 All OL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection. via CWE-693
Windows 10 (2 rules)
- V-220865 The Windows Remote Management (WinRM) service must not use Basic authentication. via CWE-693
- V-220812 Credential Guard must be running on Windows 10 domain-joined systems. via CWE-693
Windows 11 (1 rule)
- V-253418 The Windows Remote Management (WinRM) service must not use Basic authentication. via CWE-693
Windows Server 2016 (1 rule)
- V-225012 Windows Server 2016 must be running Credential Guard on domain-joined member servers. via CWE-693
Windows Server 2019 (1 rule)
- V-205907 Windows Server 2019 must be running Credential Guard on domain-joined member servers. via CWE-693
Windows Server 2022 (1 rule)
- V-254441 Windows Server 2022 must be running Credential Guard on domain-joined member servers. via CWE-693