CVE-2026-2778

The error results from improper verification of boundary conditions in DOM components: Core & HTML. Incorrect handling of memory boundaries (CWE-119 — buffer overflow or related violation) enables escape from the isolated browser sandbox environment. An attacker can craft a malicious website or email message (in Thunderbird), whose processing by the DOM engine triggers the vulnerability and allows code execution outside the sandbox.

Successful exploitation of the vulnerability leads to sandbox escape and potentially complete system takeover — the attacker can gain confidentiality, integrity, and availability of system resources (C:H/I:H/A:H in modified scope, S:C).

Update immediately to Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, or Thunderbird 140.8, depending on the update channel in use. Detailed information available in Mozilla security advisories: mfsa2026-13, mfsa2026-14, mfsa2026-15, mfsa2026-16.

Mozilla Firefox before version 148, Mozilla Firefox ESR before versions 115.33 and 140.8, Mozilla Thunderbird before version 148, and Mozilla Thunderbird before version 140.8.