CVE-2026-12289: Privilege escalation in the Graphics: WebRender component

Synopsis

A privilege escalation vulnerability exists in the Graphics: WebRender component of Mozilla Firefox and Thunderbird. The flaw is reachable over the network without any authentication, but requires a victim to take an action (such as visiting a crafted page or opening a malicious message), as indicated by the CVSS vector. Successful exploitation gives an attacker full read, write, and availability impact on the affected system, meaning they can read sensitive data, tamper with it, and disrupt the application. Patched-image rebuilds at Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim's Firefox or Thunderbird instance over the network, such as by hosting a crafted web page or email content that the victim loads remotely.

• AuthenticationNot required

  No account or credential is needed; the attacker does not need to authenticate to the target service or application.

• Victim interactionRequired

  The victim must perform an action, such as visiting a malicious page in Firefox or opening a crafted message in Thunderbird, for the exploit to trigger.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• A successful attacker reads confidential data accessible to the Firefox or Thunderbird process, including stored credentials, session tokens, and local profile data.
• An attacker can modify data within the scope of the affected process, including cached files, user preferences, or data passed between browser components.
• The attacker can crash or destabilize the affected Firefox or Thunderbird instance, causing a denial of service for the user.
• Because this is a privilege escalation vulnerability, an attacker may gain elevated capabilities beyond the browser sandbox, depending on the host environment configuration.