CVE-2026-8401

CriticalCVSS 9.8

Published: 12/05/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

23th percentile - higher than 23% of all known CVEs

Summary

A sandbox escape vulnerability exists in the Profile Backup component of Firefox and Thunderbird. This flaw was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.

Risk Assessment

An attacker could exploit this vulnerability to bypass process isolation and gain access to sensitive data or execute code outside the sandbox, posing a serious risk to system confidentiality and integrity.

Recommendation

Immediately update Firefox to version 150.0.3 or later, Firefox ESR to 115.36/140.11, and Thunderbird to version 140.11.

Original NVD description (English source)

Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.