CVE-2026-2776
Published: 24 February 2026
Summary
CVE-2026-2776 is a critical-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Mozilla Firefox. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 38.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-39 (Process Isolation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-2776 is a sandbox escape vulnerability stemming from incorrect boundary conditions in the Telemetry component of External Software. It affects Mozilla Firefox versions prior to 148, Firefox ESR versions prior to 115.33 and 140.8, Thunderbird versions prior to 148 and 140.8. The issue is associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its potential for complete system compromise.
A remote attacker can exploit this vulnerability over the network with low complexity, requiring no privileges or user interaction. Successful exploitation allows escape from the sandbox, enabling high-impact confidentiality, integrity, and availability violations across the affected scope, potentially leading to arbitrary code execution with elevated privileges.
Mozilla's security advisories (MFSA 2026-13 through 2026-16) and Bugzilla entry 2015266 detail the fix applied in the listed versions of Firefox and Thunderbird. Security practitioners should prioritize updating to these patched releases to mitigate the risk, as no additional workarounds are specified in the provided references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8498
Vulnerability details
Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Sandbox escape in client application (Firefox/Thunderbird) directly enables privilege escalation from contained process and client-side code execution via remote exploitation with no user interaction required.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely identification, reporting, and patching of flaws like CVE-2026-2776 in Mozilla software to eliminate the sandbox escape vulnerability.
Implements memory protection safeguards such as DEP and ASLR to prevent exploitation of the buffer overflow (CWE-119) underlying the sandbox escape.
Enforces robust process isolation to contain the Telemetry component within the sandbox, mitigating escape even if boundary conditions are flawed.