CVE-2026-2776 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Mozilla Firefox
CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer13 documents9 sources
Severity
10.0CRITICALNVD
EPSS
0.1%
top 76.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedFeb 24
Description
Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HExploitability: 3.9 | Impact: 6.0
Affected Packages3 packages
🔴Vulnerability Details
3GHSA▶
GHSA-v33x-35cm-8gjc: Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software↗2026-02-24
OSV▶
CVE-2026-2776: Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software↗2026-02-24
CVEList▶
Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software↗2026-02-24
📋Vendor Advisories
7🕵️Threat Intelligence
1💬Community
1Bugzilla▶
CVE-2026-2776 firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software↗2026-02-24