CVE-2026-2768

CriticalCVSS 10.0

Published: 24/02/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

29th percentile - higher than 29% of all known CVEs

Summary

A sandbox escape vulnerability exists in the Storage: IndexedDB component. This flaw was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Risk Assessment

An attacker can exploit this vulnerability to execute code outside the sandbox, potentially leading to full system compromise or data theft.

Recommendation

Immediately update Firefox to version 148 or later, and Firefox ESR to 140.8 or later. Update Thunderbird to version 148 or 140.8 depending on the branch used.

Original NVD description (English source)

Sandbox escape in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.