CVE-2026-4684

HIGH

Race condition, use-after-free in the Graphics: WebRender component

Title source: cna
STIX 2.1

Description

Race condition, use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

References (6)

Core 6

Scores

CVSS v3 7.5
EPSS 0.0027
EPSS Percentile 19.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-362 CWE-416
Status published
Products (12)
mozilla/firefox < 115.34.0
mozilla/firefox < 149.0
Mozilla/Firefox 115.34 - 115.*
Mozilla/Firefox 140.9 - 140.*
Mozilla/Firefox 149
Mozilla/Firefox unspecified - 149
Mozilla/Firefox ESR unspecified - 115.34
Mozilla/Firefox ESR unspecified - 140.9
Mozilla/Thunderbird 140.9 - 140.*
Mozilla/Thunderbird 149
... and 2 more
Published Mar 24, 2026
Tracked Since Mar 24, 2026