CVE-2026-2776

The bug concerns incorrect boundary conditions in the Telemetry component of external software, which qualifies as a CWE-119 vulnerability — improper restriction of operations within a memory buffer. This results in the possibility of escaping from the isolated sandbox environment used by Mozilla browsers to limit the impact of potential attacks. The attack vector is network-based, requires no authentication or user interaction, and the attack scope extends beyond the isolated component (S:C).

An attacker can escape from the sandbox mechanism and gain full access to confidentiality, integrity, and availability of the system, which in practice may mean taking control of the victim's host and executing arbitrary code outside the isolated browser environment.

Software must be immediately updated to the following versions: Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, or Thunderbird 140.8. Patches are available from the vendor according to references (mfsa2026-13 to mfsa2026-16).

Mozilla Firefox (versions before 148), Mozilla Firefox ESR (versions before 115.33 and before 140.8), Mozilla Thunderbird (versions before 148 and before 140.8)