CVE-2026-2776
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A sandbox escape vulnerability exists in the Telemetry component of external software due to incorrect boundary conditions. This flaw has been fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Risk Assessment
An attacker can exploit this vulnerability to break out of the sandbox and gain unauthorized access to the underlying operating system, potentially leading to full application compromise and data exposure.
Recommendation
Immediately update Firefox to version 148 or later, Firefox ESR to 115.33/140.8, and Thunderbird to 148/140.8. Verify that no older versions are in use within the organization.
Original NVD description (English source)
Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.