CVE-2026-2760: 
NixOS vulnerability analysis and mitigation

CVE-2026-2760 is a sandbox escape vulnerability caused by incorrect boundary conditions in the Graphics: WebRender component of Mozilla Firefox and Thunderbird. The flaw was discovered by security researcher Oskar L. via manual auditing and disclosed on February 24, 2026. It affects Firefox prior to version 148, Firefox ESR prior to 115.33, Firefox ESR prior to 140.8, Thunderbird prior to 148, and Thunderbird ESR prior to 140.8. The vulnerability carries a CVSS v3.1 base score of 10.0 (Critical) (Mozilla Advisory MFSA2026-15, Feedly).

The root cause is an out-of-bounds read/write (CWE-125/CWE-787) in the YUV-to-RGB color conversion pipeline within Firefox's WebRender graphics subsystem. Specifically, the DataSourceSurfaceFromYCbCrDescriptor function in ImageDataSerializer.cpp passes the display rectangle's origin coordinates (including the pic_y offset) directly to ConvertYCbCrToRGB32_deprecated without validating that they are non-negative. An attacker who has already achieved code execution in a sandboxed content process can craft a malicious YCbCr texture descriptor with a negative display rect origin (e.g., y = -100), causing the conversion loop to compute out-of-bounds source and destination pixel addresses, resulting in heap buffer over-read and over-write (Mozilla Bugzilla). This code path is triggered on hardware lacking SSE3 support or when the gfx.ycbcr.accurate-conversion preference is enabled, meaning exploitation is hardware-dependent (Mozilla Bugzilla). The fix rejects negative origin or stride values in the YUV-to-RGB conversion function before processing begins.

Successful exploitation allows a compromised sandboxed content process to escape the Firefox/Thunderbird sandbox and achieve arbitrary memory read and write in the parent (privileged) process. This results in complete system compromise with high confidentiality, integrity, and availability impact — an attacker can access sensitive data, modify system state, and potentially disrupt services. Because the scope is changed (sandbox boundary crossed), the impact extends beyond the browser process to the underlying operating system, enabling further lateral movement or persistent access (Mozilla Advisory MFSA2026-13, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The EPSS score is approximately 0.024%, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a prior sandbox compromise (e.g., a separate RCE bug in the content process) and is further constrained to hardware without SSE3 or systems with the non-default gfx.ycbcr.accurate-conversion preference enabled, which limits the realistic attacker population (Mozilla Bugzilla). Mozilla awarded a security bounty for this report, indicating it was assessed as a credible and impactful finding.

1. Prerequisite — Achieve content process RCE: Exploit a separate vulnerability (e.g., a use-after-free or memory corruption bug in the JavaScript engine or DOM) to gain arbitrary code execution within Firefox's sandboxed content process.
2. Identify target hardware/configuration: Confirm the target system lacks SSE3 CPU support, or that the gfx.ycbcr.accurate-conversion preference is enabled in Firefox, as the vulnerable code path (ConvertYCbCrToRGB32_deprecated) is only reached under these conditions.
3. Craft malicious YCbCr texture: From within the compromised content process, use the WebRender IPC API (ContentCompositorBridgeParent::AllocPTextureParent) to allocate a YCbCr texture backed by shared memory, specifying a YCbCrDescriptor with a negative display rect origin (e.g., y = -100).
4. Trigger texture conversion: Cause the texture to be used in a WebRender operation (e.g., via an <img> or OffscreenCanvas rendering path) so that BufferTextureHost::GetAsSurface is called, invoking DataSourceSurfaceFromYCbCrDescriptor with the malicious descriptor.
5. Achieve out-of-bounds memory access: The negative pic_y value causes the conversion loop to compute pixel addresses before the allocated buffer, resulting in heap OOB read/write in the parent compositor process, outside the sandbox.
6. Leverage for sandbox escape: Use the OOB write primitive to corrupt parent process memory (e.g., function pointers, vtables) to redirect execution and achieve full sandbox escape with parent process privileges (Mozilla Bugzilla).

Mozilla has released patches addressing this vulnerability in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird ESR 140.8. Organizations should immediately update all affected Firefox and Thunderbird installations to these minimum versions. As a temporary workaround where immediate patching is not feasible, restricting access to untrusted websites and ensuring the gfx.ycbcr.accurate-conversion preference remains at its default (disabled) value can reduce exposure, though this does not fully mitigate the risk on non-SSE3 hardware. Downstream Linux distributions (Red Hat, Debian, SUSE, AlmaLinux, Rocky Linux, Oracle Linux, Slackware, Amazon Linux) have also released updated packages (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-15).

The vulnerability was reported by external researcher Oskar L. through Mozilla's bug bounty program and received a security bounty award, reflecting Mozilla's assessment of its severity and impact (Mozilla Bugzilla). Mozilla engineer Daniel Veditz noted in the bug discussion that exploitation of this flaw would typically require a separate RCE bug in the sandboxed content process as a prerequisite, contextualizing it as a second-stage sandbox escape primitive. Coverage appeared across Linux security advisory aggregators and security news outlets such as CyberInsider, which highlighted the sandbox escape fixes in Firefox 148 alongside other security improvements.