Executive brief
A critical vulnerability was identified in the graphics rendering engine used by Firefox and Thunderbird. This flaw allows a malicious website or email to bypass the security 'sandbox' that normally keeps web content isolated from the rest of the computer. If exploited, an attacker could potentially gain full control over the user's system, leading to data theft or the installation of malware.
Technical details
A sandbox escape vulnerability exists in the Graphics: WebRender component of Mozilla products due to incorrect boundary conditions during YUV to RGB color conversion. Specifically, the 'ImageDataSerializer::DataSourceSurfaceFromYCbCrDescriptor' function and subsequent conversion routines (like 'ConvertYCbCrToRGB32_deprecated') fail to properly validate dimensions when extracting data surfaces from shared memory (shmem) backed textures. An attacker can provide a specially crafted YCbCr descriptor that triggers out-of-bounds reads or writes (OOBW/R). This can be leveraged to escape the content process sandbox and achieve remote code execution with the privileges of the user. The vulnerability is fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, and Thunderbird versions 148 and 140.8.
Affected products
- Mozilla Firefox < 148
- Mozilla Firefox ESR < 115.33, < 140.8
- Mozilla Thunderbird < 148, < 140.8
Timeline
- 2026-02-24: advisory: Mozilla Foundation Security Advisory published.
- 2026-02-24: patched: Fixed in Firefox 148 and related ESR/Thunderbird releases.
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2011062
- https://www.mozilla.org/security/advisories/mfsa2026-13/
- https://www.mozilla.org/security/advisories/mfsa2026-14/
- https://www.mozilla.org/security/advisories/mfsa2026-15/
- https://www.mozilla.org/security/advisories/mfsa2026-16/
- https://www.mozilla.org/security/advisories/mfsa2026-17/
- https://access.redhat.com/errata/RHSA-2026:3338