Vulnerability · Published Feb 24, 2026 · Assigned by mozilla
CVE-2026-2776Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software
Critical 10.0
In plain English
A critical-severity memory corruption in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)0.6%top 53.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | firefox | 140.8.0-2.el10_1 | ALSA-2026:3361 |
| AlmaLinux:8 | firefox | 140.8.0-2.el8_10.alma.1 | ALSA-2026:3338 |
| AlmaLinux:9 | firefox | 140.8.0-2.el9_7.alma.1 | ALSA-2026:3339 |
| AlmaLinux:9 | firefox-x11 | 140.8.0-2.el9_7.alma.1 | ALSA-2026:3339 |
| AlmaLinux:10 | thunderbird | 140.8.0-2.el10_1.alma.1 | ALSA-2026:3517 |
| AlmaLinux:8 | thunderbird | 140.8.0-1.el8_10.alma.1 | ALSA-2026:3515 |
| AlmaLinux:9 | thunderbird | 140.8.0-1.el9_7.alma.1 | ALSA-2026:3516 |
| Debian:12 | firefox-esr | 140.8.0esr-1~deb12u1 | DSA-6148-1 |
| Debian:12 | firefox-esr | 140.8.0esr-1~deb12u1 | DEBIAN-CVE-2026-2776 |
| Debian:13 | firefox-esr | 140.8.0esr-1~deb13u1 | DEBIAN-CVE-2026-2776 |
| Debian:13 | firefox-esr | 140.8.0esr-1~deb13u1 | DSA-6148-1 |
| Debian:14 | firefox-esr | 140.8.0esr-1 | DEBIAN-CVE-2026-2776 |
| Debian:12 | thunderbird | 1:140.8.0esr-1~deb12u1 | DSA-6152-1 |
| Debian:12 | thunderbird | 1:140.8.0esr-1~deb12u1 | DEBIAN-CVE-2026-2776 |
| Debian:13 | thunderbird | 1:140.8.0esr-1~deb13u1 | DEBIAN-CVE-2026-2776 |
| Debian:13 | thunderbird | 1:140.8.0esr-1~deb13u1 | DSA-6152-1 |
| Debian:14 | thunderbird | 1:140.8.0esr-1 | DEBIAN-CVE-2026-2776 |
| Rocky Linux:10 | firefox | 0:140.8.0-2.el10_1 | RLSA-2026:3361 |
| Rocky Linux:8 | firefox | 0:140.8.0-2.el8_10 | RLSA-2026:3338 |
| Rocky Linux:9 | firefox | 0:140.8.0-2.el9_7 | RLSA-2026:3339 |
| Rocky Linux:10 | thunderbird | 0:140.8.0-2.el10_1 | RLSA-2026:3517 |
| Rocky Linux:8 | thunderbird | 0:140.8.0-1.el8_10 | RLSA-2026:3515 |
| Rocky Linux:9 | thunderbird | 0:140.8.0-1.el9_7 | RLSA-2026:3516 |
| Ubuntu:22.04:LTS | mozjs102 | no fix listed | UBUNTU-CVE-2026-2776 |
| Ubuntu:24.04:LTS | mozjs102 | no fix listed | UBUNTU-CVE-2026-2776 |
| Ubuntu:24.04:LTS | mozjs115 | no fix listed | UBUNTU-CVE-2026-2776 |
| Ubuntu:22.04:LTS | mozjs78 | no fix listed | UBUNTU-CVE-2026-2776 |
| Ubuntu:22.04:LTS | mozjs91 | no fix listed | UBUNTU-CVE-2026-2776 |
| Ubuntu:22.04:LTS | thunderbird | no fix listed | UBUNTU-CVE-2026-2776 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | see references |
| Mozilla | Thunderbird | see references |
Weakness: CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2015266
- https://www.mozilla.org/security/advisories/mfsa2026-13/
- https://www.mozilla.org/security/advisories/mfsa2026-14/
- https://www.mozilla.org/security/advisories/mfsa2026-15/
- https://www.mozilla.org/security/advisories/mfsa2026-16/
- https://www.mozilla.org/security/advisories/mfsa2026-17/
- https://access.redhat.com/security/cve/CVE-2026-2776 vdb-entry, x_refsource_REDHAT
- RHBZ#2442291 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2776.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:3984 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3976 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4260 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3361 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3517 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3338 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3515 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3492 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4432 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3491 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3980 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3495 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3979 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3494 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4022 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3493 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3983 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4152 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3978 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3496 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3981 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3497 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3982 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3339 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3516 vendor-advisory, x_refsource_REDHAT