CVE-2026-8401
Published: 12 May 2026
Summary
CVE-2026-8401 is a critical-severity Protection Mechanism Failure (CWE-693) vulnerability in Mozilla Firefox. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 23.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-29493
Vulnerability details
Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Sandbox escape in browser component directly enables privilege escalation from restricted renderer/process context to host OS access.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
The CONOPS must articulate isolation and compartmentalization expectations for security and privacy, making architectural failures in separation of duties or domains harder to overlook.
Security architectures commonly incorporate isolation and compartmentalization strategies to limit the impact of compromises.
Organization-wide privacy program leadership ensures proper isolation and compartmentalization of personal data.
Architecture explicitly designs isolation, segmentation, and compartmentalization (e.g., networks, data flows), preventing improper isolation weaknesses.
Requires the architecture to show how functions work together as a unified protection approach, reducing improper isolation or compartmentalization.
Isolation and compartmentalization techniques are core to tamper resistance, limiting an attacker's ability to reach or alter protected components.
Mandates selection and application of resiliency techniques and implementation approaches that strengthen protection mechanisms against failure or bypass.
Separation-of-privilege and least-common-mechanism principles enforce proper isolation.