Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Firefox and Thunderbird allow sandbox escape via graphics bug

CVE-2026-118023 · published 8 days ago
Summary

Both Firefox and Thunderbird have a flaw in their graphics rendering code that could let malicious content break out of the browser's security sandbox. This could let attackers run code on a user's computer. Updating to the latest version resolves the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
mozilla firefox All versions
mozilla thunderbird All versions
Original advisory text
Sandbox escape due to use-after-free in the Graphics: WebRender component
Sandbox escape due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Exploitation
<1% chance of attack within 30 days
Timeline
Published27 Oct 2026
Updated28 Oct 2026
First seen27 Oct 2026
Sources
CVE-2026-118023 · NVD
CVE-2026-118023 · MITRE
Track software like this
Free during beta