CVE-2026-2768
Published: 24 February 2026
Summary
CVE-2026-2768 is a critical-severity Improper Access Control (CWE-284) vulnerability in Mozilla Firefox. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 28.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2026-2768 is a sandbox escape vulnerability in the Storage: IndexedDB component of Mozilla Firefox and Thunderbird. It affects versions of Firefox prior to 148, Firefox ESR prior to 140.8, Thunderbird prior to 148, and Thunderbird prior to 140.8. The issue carries a maximum CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and is associated with CWE-284 (Improper Access Control) and CWE-693 (Protection Mechanism Failure).
The vulnerability can be exploited remotely over the network by any unauthenticated attacker with low complexity and no user interaction required. Successful exploitation changes the scope to achieve high impacts on confidentiality, integrity, and availability, allowing an attacker to escape the browser sandbox and potentially execute arbitrary code or access sensitive data outside the intended isolation.
Mozilla's security advisories (MFSA 2026-13, 15, 16, and 17) and the associated Bugzilla entry (bug 2014101) confirm the vulnerability was addressed in the specified fixed releases. Security practitioners should prioritize updating affected Firefox and Thunderbird installations to versions 148 or Firefox ESR/Thunderbird 140.8 or later to mitigate the risk.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8490
Vulnerability details
Sandbox escape in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Sandbox escape in client browser/email app with remote unauthenticated RCE and scope change directly enables T1203 (Exploitation for Client Execution) and T1068 (Exploitation for Privilege Escalation) to break isolation and run code outside sandbox.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely identification, reporting, and correction of the IndexedDB sandbox escape flaw via patching to Firefox 148, ESR 140.8, or Thunderbird equivalents.
Supports scanning to detect systems with vulnerable Firefox or Thunderbird versions prior to the fixed releases, enabling targeted remediation.
Mandates receiving and acting on Mozilla MFSA advisories (2026-13, 15, 16, 17) to promptly patch this sandbox escape vulnerability.
Hardening callouts derived
Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).
Oracle Linux 8 (4 rules)
- V-248524 OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. via CWE-693
- V-248525 All OL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection. via CWE-693
- V-248597 There must be no "shosts.equiv" files on the OL 8 operating system. via CWE-284
Oracle Linux 9 (2 rules)
- V-271758 OL 9 file systems must not contain .shosts files. via CWE-284
- V-271757 OL 9 file systems must not contain shosts.equiv files. via CWE-284
RHEL 7 (2 rules)
- V-204606 The Red Hat Enterprise Linux operating system must not contain .shosts files. via CWE-284
- V-204607 The Red Hat Enterprise Linux operating system must not contain shosts.equiv files. via CWE-284
RHEL 8 (2 rules)
- V-230284 There must be no .shosts files on the RHEL 8 operating system. via CWE-284
- V-230283 There must be no shosts.equiv files on the RHEL 8 operating system. via CWE-284
Windows 10 (2 rules)
- V-220865 The Windows Remote Management (WinRM) service must not use Basic authentication. via CWE-693
- V-220812 Credential Guard must be running on Windows 10 domain-joined systems. via CWE-693
Windows 11 (1 rule)
- V-253418 The Windows Remote Management (WinRM) service must not use Basic authentication. via CWE-693
Windows Server 2016 (1 rule)
- V-225012 Windows Server 2016 must be running Credential Guard on domain-joined member servers. via CWE-693
Windows Server 2019 (1 rule)
- V-205907 Windows Server 2019 must be running Credential Guard on domain-joined member servers. via CWE-693
Windows Server 2022 (1 rule)
- V-254441 Windows Server 2022 must be running Credential Guard on domain-joined member servers. via CWE-693