Vulnerability · Published Feb 24, 2026 · Assigned by mozilla
CVE-2026-2768Sandbox escape in the Storage: IndexedDB component
Critical 10.0
In plain English
A critical-severity improper access control in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)0.4%top 61.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
Sandbox escape in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | firefox | 140.8.0-2.el10_1 | ALSA-2026:3361 |
| AlmaLinux:8 | firefox | 140.8.0-2.el8_10.alma.1 | ALSA-2026:3338 |
| AlmaLinux:9 | firefox | 140.8.0-2.el9_7.alma.1 | ALSA-2026:3339 |
| AlmaLinux:9 | firefox-x11 | 140.8.0-2.el9_7.alma.1 | ALSA-2026:3339 |
| AlmaLinux:10 | thunderbird | 140.8.0-2.el10_1.alma.1 | ALSA-2026:3517 |
| AlmaLinux:8 | thunderbird | 140.8.0-1.el8_10.alma.1 | ALSA-2026:3515 |
| AlmaLinux:9 | thunderbird | 140.8.0-1.el9_7.alma.1 | ALSA-2026:3516 |
| Debian:12 | firefox-esr | 140.8.0esr-1~deb12u1 | DSA-6148-1 |
| Debian:12 | firefox-esr | 140.8.0esr-1~deb12u1 | DEBIAN-CVE-2026-2768 |
| Debian:13 | firefox-esr | 140.8.0esr-1~deb13u1 | DEBIAN-CVE-2026-2768 |
| Debian:13 | firefox-esr | 140.8.0esr-1~deb13u1 | DSA-6148-1 |
| Debian:14 | firefox-esr | 140.8.0esr-1 | DEBIAN-CVE-2026-2768 |
| Debian:12 | thunderbird | 1:140.8.0esr-1~deb12u1 | DSA-6152-1 |
| Debian:12 | thunderbird | 1:140.8.0esr-1~deb12u1 | DEBIAN-CVE-2026-2768 |
| Debian:13 | thunderbird | 1:140.8.0esr-1~deb13u1 | DEBIAN-CVE-2026-2768 |
| Debian:13 | thunderbird | 1:140.8.0esr-1~deb13u1 | DSA-6152-1 |
| Debian:14 | thunderbird | 1:140.8.0esr-1 | DEBIAN-CVE-2026-2768 |
| Rocky Linux:10 | firefox | 0:140.8.0-2.el10_1 | RLSA-2026:3361 |
| Rocky Linux:8 | firefox | 0:140.8.0-2.el8_10 | RLSA-2026:3338 |
| Rocky Linux:9 | firefox | 0:140.8.0-2.el9_7 | RLSA-2026:3339 |
| Rocky Linux:10 | thunderbird | 0:140.8.0-2.el10_1 | RLSA-2026:3517 |
| Rocky Linux:8 | thunderbird | 0:140.8.0-1.el8_10 | RLSA-2026:3515 |
| Rocky Linux:9 | thunderbird | 0:140.8.0-1.el9_7 | RLSA-2026:3516 |
| Ubuntu:22.04:LTS | mozjs102 | no fix listed | UBUNTU-CVE-2026-2768 |
| Ubuntu:24.04:LTS | mozjs102 | no fix listed | UBUNTU-CVE-2026-2768 |
| Ubuntu:24.04:LTS | mozjs115 | no fix listed | UBUNTU-CVE-2026-2768 |
| Ubuntu:22.04:LTS | mozjs78 | no fix listed | UBUNTU-CVE-2026-2768 |
| Ubuntu:22.04:LTS | mozjs91 | no fix listed | UBUNTU-CVE-2026-2768 |
| Ubuntu:22.04:LTS | thunderbird | no fix listed | UBUNTU-CVE-2026-2768 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | see references |
| Mozilla | Thunderbird | see references |
Weakness: CWE-693, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2014101
- https://www.mozilla.org/security/advisories/mfsa2026-13/
- https://www.mozilla.org/security/advisories/mfsa2026-15/
- https://www.mozilla.org/security/advisories/mfsa2026-16/
- https://www.mozilla.org/security/advisories/mfsa2026-17/
- https://access.redhat.com/security/cve/CVE-2026-2768 vdb-entry, x_refsource_REDHAT
- RHBZ#2442298 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2768.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:3984 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3976 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4260 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3361 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3517 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3338 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3515 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3492 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4432 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3491 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3980 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3495 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3979 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3494 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4022 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3493 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3983 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4152 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3978 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3496 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3981 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3497 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3982 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3339 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3516 vendor-advisory, x_refsource_REDHAT