CVE-2026-2768: Mozilla Firefox and Thunderbird sandbox escape in IndexedDB

CVE-2026-2768 · Severity: critical · CVSS 10 · Published 2026-02-24

A critical security vulnerability has been identified in Mozilla Firefox and Thunderbird's IndexedDB component, which is used by websites to store data locally in the browser. This flaw allows a malicious website or a compromised browser process to bypass security 'sandboxing' protections that normally keep web content isolated from the rest of the computer. If exploited, an attacker could gain full control over the user's system, potentially leading to the theft of sensitive data, installation of malware, or complete service disruption.

Technologies: Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird, Mozilla Thunderbird ESR, Red Hat Enterprise Linux AppStream. Vendors: Mozilla, Red Hat.

Quick answers

Is CVE-2026-2768 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-2768 being exploited in the wild.
How severe is CVE-2026-2768?
Critical severity, with a CVSS score of 10, published 24 February 2026.
Which products and versions are affected?
Mozilla Firefox < 148; Mozilla Firefox ESR < 140.8; Mozilla Thunderbird < 148; Mozilla Thunderbird ESR < 140.8; and 1 more.
Is there a fix for CVE-2026-2768?
A patch was published on 2026-02-24: Fixed in Firefox 148 and related versions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-2768 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-2768?
Check whether you run Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap out-of-bounds (OOB) write vulnerability exists in the 'Storage: IndexedDB' component of Mozilla browsers. The root cause is a failure to validate 'mAutoIncrementKeyOffsets' during IPC deserialization in 'dom/indexedDB/SerializationHelpers.h'. A compromised content process can forge an 'ObjectStoreAddParams' IPC message with arbitrary offset values. When the parent process processes this message via 'MaybeUpdateAutoIncrementKey', it performs an 8-byte write at an attacker-controlled offset relative to the 'mBuffer' data pointer. This allows for an arbitrary relative heap write in the parent process, facilitating a full sandbox escape. The vulnerability is fixed in Firefox 148, Firefox ESR 140.8, and Thunderbird 148/140.8.

Affected products

  • Mozilla Firefox < 148
  • Mozilla Firefox ESR < 140.8
  • Mozilla Thunderbird < 148
  • Mozilla Thunderbird ESR < 140.8
  • Red Hat Red Hat Enterprise Linux Server 7 ELS affected
  • Red Hat Red Hat Enterprise Linux AppStream EUS 10.0 affected

Timeline

  • 2026-02-24: advisory: Mozilla Foundation Security Advisory 2026-13 published.
  • 2026-02-24: patched: Fixed in Firefox 148 and related versions.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.