CVE-2026-2761: 
NixOS vulnerability analysis and mitigation

CVE-2026-2761 is a sandbox escape vulnerability in the Graphics: WebRender component of Mozilla Firefox and Thunderbird, discovered and reported by security researcher Oskar L. The flaw affects Firefox versions before 148, Firefox ESR before 115.33 (for the 115.x branch) and before 140.8 (for the 128.x+ branch), as well as Thunderbird before 148 and Thunderbird ESR before 140.8. It was publicly disclosed on February 24, 2026, alongside Mozilla's security advisories for Firefox 148, Firefox ESR 115.33, and Firefox ESR 140.8. The vulnerability carries a CVSS v3.1 base score of 10.0 (Critical) (Mozilla Advisory mfsa2026-13, Mozilla Advisory mfsa2026-15, Feedly).

The root cause is a Protection Mechanism Failure (CWE-693) in WebRenderBridgeParent::RecvGetSnapshot, which handles snapshot requests from the content process onto shared memory via the WebRenderBridge IPC actor. The function assumes a fixed bytes-per-pixel (bpp) of 4 when calculating the texture buffer size (buffer_size = width * height * 4), but fails to validate the actual pixel format of the supplied texture. A compromised content process can supply a texture with a different format (e.g., SurfaceFormat::A8, which is 1 bpp), causing the parent process to call RenderCompositorANGLE::MaybeReadback with a mismatched buffer size, resulting in an out-of-bounds read (OOBR) and subsequent memcpy into an undersized buffer — effectively a sandbox escape. The vulnerability is exploitable remotely over the network with no privileges and no user interaction required, as reflected in its perfect CVSS score (Mozilla Bugzilla, Mozilla Advisory mfsa2026-13). The fix rejects snapshot readback requests for unsupported or mismatched pixel formats.

Successful exploitation allows a compromised browser content process to escape the Firefox sandbox and execute arbitrary code with the privileges of the parent (GPU or browser) process, potentially achieving full system compromise. This enables an attacker to access sensitive data on the host system, modify system files, install malware, or pivot to other systems on the network. The vulnerability affects all major platforms where Firefox and Thunderbird run, including Windows (where the ANGLE compositor path is confirmed vulnerable), and potentially Android and other platforms (Mozilla Bugzilla, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.024%, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the CVSS 10.0 score — reflecting network-accessible, no-authentication, no-user-interaction exploitation with a changed scope — indicates that a weaponized exploit chaining this with an initial content-process compromise would be highly impactful. No threat actor attribution has been reported.

1. Gain content process execution: Exploit a separate vulnerability (e.g., a JavaScript engine bug or renderer flaw) to achieve code execution within a Firefox content process, which is sandboxed.
2. Craft a malicious texture: From within the compromised content process, create a TextureClient with a non-RGBA/BGRA format (e.g., SurfaceFormat::A8, 1 bpp) and a controlled size (e.g., 0x400 × 4 pixels), using TextureClient::CreateForRawBufferAccess.
3. Send malformed IPC message: Call WrBridge()->SendGetSnapshot() with the malformed texture actor, sending an IPC message to the parent (GPU) process's WebRenderBridgeParent::RecvGetSnapshot handler.
4. Trigger out-of-bounds read: The parent process calculates buffer_size = width * height * 4 (assuming 4 bpp), but the actual texture buffer is smaller (1 bpp). The call to RenderCompositorANGLE::MaybeReadback performs a memcpy reading beyond the allocated texture buffer, exfiltrating adjacent parent process memory into the shared texture buffer.
5. Achieve sandbox escape: The out-of-bounds memory read allows the attacker to read parent process memory (potentially including sensitive data or code pointers), and the write into the shared buffer can be used to corrupt memory in the parent process, enabling code execution outside the sandbox (Mozilla Bugzilla).

• Process: Unexpected child processes spawned by the Firefox GPU process (e.g., cmd.exe, powershell.exe, bash, sh) on Windows or Linux systems.
• Logs: Firefox crash reports or GPU process crashes referencing WebRenderBridgeParent::RecvGetSnapshot, RenderCompositorANGLE::MaybeReadback, or RendererOGL::UpdateAndRender in stack traces.
• Network: Unusual outbound network connections originating from the Firefox GPU process (plugin-container.exe or equivalent) to external IPs shortly after browser use.
• File System: Unexpected files written to user profile directories or temp directories by the Firefox GPU process; new scheduled tasks or persistence mechanisms created under the browser's user account.
• Memory/ASAN: AddressSanitizer reports of access-violation in memcpy/memcmp within RenderCompositorANGLE.cpp at line ~1083 (Mozilla Bugzilla).

Mozilla has released patched versions addressing this vulnerability: Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird ESR 140.8. The fix rejects snapshot readback requests for unsupported pixel formats, turning the unsafe assertion into an explicit error/rejection that crashes the content process rather than allowing the parent process memory to be read. Organizations should prioritize upgrading all Firefox and Thunderbird installations immediately given the critical CVSS 10.0 score. No configuration-based workaround is available; patching is the only remediation. Linux distribution vendors (Red Hat, Debian, SUSE, AlmaLinux, Rocky Linux, Oracle Linux, Slackware, Amazon Linux) have also released updated packages (Mozilla Advisory mfsa2026-13, Mozilla Advisory mfsa2026-14, Mozilla Advisory mfsa2026-15).

The vulnerability was reported by external researcher Oskar L. through Mozilla's bug bounty program and was awarded a security bounty (sec-bounty+). Mozilla classified it as sec-high and fast-tracked it for uplift to all supported ESR branches. Coverage appeared on CyberInsider noting Firefox 148's sandbox escape patches, and multiple Linux security news outlets covered the downstream distribution updates. No significant public controversy or notable social media discussion beyond standard patch notification has been observed (Mozilla Bugzilla, Mozilla Advisory mfsa2026-13).