Executive brief
A critical vulnerability was identified in Mozilla Firefox and Thunderbird that could allow an attacker to escape the browser's security sandbox. This component, WebRender, is responsible for drawing web content on the screen. An exploit could allow a malicious website to gain unauthorized access to the underlying operating system, potentially leading to full system compromise or the theft of sensitive user data.
Technical details
An out-of-bounds write (OOBW) exists in the Graphics: WebRender component of Mozilla products. The vulnerability is rooted in `WebRenderBridgeParent::RecvGetSnapshot`, which incorrectly assumes a fixed 4 bytes-per-pixel (bpp) format when calculating buffer sizes for snapshots in shared memory. By providing an unvalidated or unexpected format through the WebRender API, a compromised content process can trigger a `memcpy` that exceeds the allocated buffer size in the parent process. This facilitates a sandbox escape, allowing an attacker to achieve code execution in the context of the parent process. The issue was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, and corresponding Thunderbird releases.
Affected products
- Mozilla Firefox < 148
- Mozilla Firefox ESR < 115.33, < 140.8
- Mozilla Thunderbird < 148, < 140.8
Timeline
- 2026-02-24: disclosed
- 2026-02-24: patched
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2011063
- https://www.mozilla.org/security/advisories/mfsa2026-13/
- https://www.mozilla.org/security/advisories/mfsa2026-14/
- https://www.mozilla.org/security/advisories/mfsa2026-15/
- https://www.mozilla.org/security/advisories/mfsa2026-16/
- https://www.mozilla.org/security/advisories/mfsa2026-17/
- https://access.redhat.com/errata/RHSA-2026:3338