Loading vulnerability…
Privilege Escalation in Mozilla WebRender
CVE-2026-12289 is an improper privilege-management vulnerability in Mozilla's Graphics: WebRender component. It may allow an attacker to gain elevated privileges in affected Firefox and Thunderbird installations.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in privilege escalation, giving an attacker elevated access on the affected system.
If you can’t patch tonight, do this now.
No product-specific workaround is available. Apply the affected-product updates promptly; until patching is complete, reduce exposure to untrusted web content and operate users without administrative privileges.
Patch, then assume compromise.
Upgrade to Firefox 152, Firefox ESR 140.12 or 115.37, Thunderbird 152, or Thunderbird ESR 140.12, as applicable. These releases contain the fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.