CVE-2026-2777: Mozilla Firefox and Thunderbird privilege escalation in Messaging System

CVE-2026-2777 · Severity: critical · CVSS 9.8 · Published 2026-02-24

A vulnerability in the messaging system of Firefox and Thunderbird could allow a malicious website to gain elevated privileges on a user's computer. If exploited, an attacker who has already compromised a browser process could bypass security prompts to install malicious browser extensions or hijack the user's homepage. This could lead to full control over the browser, theft of sensitive data, or persistent monitoring of user activity.

Technologies: Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird, Red Hat Enterprise Linux Server 7 ELS. Vendors: Mozilla, Red Hat.

Quick answers

Is CVE-2026-2777 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-2777 being exploited in the wild.
How severe is CVE-2026-2777?
Critical severity, with a CVSS score of 9.8, published 24 February 2026.
Which products and versions are affected?
Mozilla Firefox < 148; Mozilla Firefox ESR < 115.33, < 140.8; Mozilla Thunderbird < 148, < 140.8; Red Hat Enterprise Linux Server 7 ELS affected.
Is there a fix for CVE-2026-2777?
A patch was published on 2026-02-24: Fixed in Firefox 148 and ESR releases. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-2777 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-2777?
Check whether you run Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A privilege escalation vulnerability exists in the Messaging System component of Mozilla browsers due to missing 'remoteTypes' restrictions on the 'AboutMessagePreviewParent' JSWindowActor. This omission allows a compromised content process to communicate with the parent process and invoke 'SpecialMessageActions.handleAction()' without proper authorization. An attacker can exploit this to trigger privileged actions such as 'INSTALL_ADDON_FROM_URL' (which uses SystemPrincipal to bypass site-level installation prompts) or 'SET_PREF' to modify browser settings like the homepage. The attack involves spoofing the document URI to 'about:messagepreview' via 'RecvUpdateDocumentURI' to bypass parent-side match checks. Patches are available in Firefox 148, Firefox ESR 115.33, and Firefox ESR 140.8.

Affected products

  • Mozilla Firefox < 148
  • Mozilla Firefox ESR < 115.33, < 140.8
  • Mozilla Thunderbird < 148, < 140.8
  • Red Hat Red Hat Enterprise Linux Server 7 ELS affected

Timeline

  • 2026-02-24: advisory: Mozilla Foundation Security Advisory 2026-13 published.
  • 2026-02-24: patched: Fixed in Firefox 148 and ESR releases.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.