Evil-DB LogoEvil-DB
← All CVEs

CVE-2026-2776

critical · 10

Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

10
CVSS
0.5%
EPSS (exploit prob.)
41st
EPSS percentile
2026-02-24
Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-119

Affected products

VendorProductAffected versions
mozillafirefox< 115.33.0
mozillafirefox< 148.0
mozillafirefox>= 128.0, < 140.8.0
mozillathunderbird< 140.8.0
mozillathunderbird< 148.0

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-2776