Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Race condition, use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-24 | 1 | Disclosure1 |
| 2026-06-12 | 1 | Patch1 |
CVE-2026-4684 Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9. https://www.cve.org/CVERecord?id=CVE-2026-4684
Post summary
The post announces CVE-2026-4684, a race condition and use‑after‑free in Firefox’s WebRender component, impacting specified pre‑v149 and ESR versions.
Oracle released new Firefox 140.8.0 ESR and 140.9.0 ESR builds for Oracle Linux 7 addressing 39 CVEs, including CVE-2026-2447 and CVE-2026-4684, according to advisory ELSA-2026. https://threatcluster.io/cluster/oracle-linux-7-firefox-security-updates-address-multiple-cve-b8b9b55f
Post summary
Oracle issued new Firefox ESR updates for Linux 7 that patch 39 CVEs, including CVE-2026-2447 and CVE-2026-4684, as announced in advisory ELSA-2026.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | mozilla | firefox | - | - | - |
| App | mozilla | firefox | - | - | - |