CVE-2026-2768

The vulnerability concerns improper access control (CWE-284) and insufficient defensive mechanisms (CWE-693) in the IndexedDB component responsible for local data storage. An attacker can exploit this vulnerability remotely, without authentication and without user interaction, to break out of the browser's isolated sandbox environment. Sandbox escape allows operations to be performed outside the application's restricted context, meaning the ability to impact host operating system resources.

Successful exploitation of this vulnerability may enable an attacker to gain complete control over the victim's system — including gaining access to data, modifying resources, and disrupting system operation. The attack vector is network-based, and the lack of privilege and user interaction requirements makes this vulnerability particularly dangerous.

Immediate update to Firefox 148, Firefox ESR 140.8, Thunderbird 148, or Thunderbird 140.8 is required, where the vulnerability has been patched. Updates are available directly through Mozilla products' automatic update mechanism or from the manufacturer's websites in accordance with published security bulletins.

Mozilla Firefox (versions prior to 148), Mozilla Firefox ESR (versions prior to 140.8), Mozilla Thunderbird (versions prior to 148), Mozilla Thunderbird ESR (versions prior to 140.8)