# CVE-2026-8401: Mozilla Firefox sandbox escape in Profile Backup

Source: https://junglewise.ai/threats/cve-2026-8401-mozilla-firefox-sandbox-escape-in-profile-backup  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2026-8401 · Severity: critical · CVSS 9.8 · Published 2026-05-12

A critical security vulnerability has been identified in the Mozilla Firefox web browser's Profile Backup feature. This flaw allows a malicious website to break out of the browser's security sandbox, which is designed to keep web content isolated from the rest of the computer. If exploited, an attacker could gain unauthorized access to the underlying operating system, potentially leading to the theft of sensitive files or the installation of malware.

Technologies: [Mozilla Firefox](https://junglewise.ai/threats/technologies/firefox). Vendors: [Mozilla](https://junglewise.ai/threats/vendors/mozilla).

## Quick answers

**Is CVE-2026-8401 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8401 being exploited in the wild.

**How severe is CVE-2026-8401?** Critical severity, with a CVSS score of 9.8, published 12 May 2026.

**Which products and versions are affected?** Mozilla Firefox Fixed in 150.0.3.

**Is there a fix for CVE-2026-8401?** A patch was published on 2026-05-12: Fixed in Firefox 150.0.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-8401 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-8401?** Check whether you run Mozilla Firefox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A sandbox escape vulnerability exists within the Profile Backup component of Mozilla Firefox. While specific technical root causes are restricted in the associated bug reports, the flaw allows a process running within the content sandbox to bypass security boundaries and execute code with the privileges of the parent process or the local user. This is typically achieved by exploiting logic errors or memory corruption within the backup routine to interact with restricted system resources. An attacker could leverage this by enticing a user to visit a malicious webpage, leading to full system compromise. The issue is resolved in Firefox version 150.0.3.

## Affected products

- Mozilla Firefox Fixed in 150.0.3

## Timeline

- 2026-05-12: disclosed
- 2026-05-12: patched: Fixed in Firefox 150.0.3
- 2026-05-12: advisory

## References

- [https://bugzilla.mozilla.org/show_bug.cgi?id=2038679](https://bugzilla.mozilla.org/show_bug.cgi?id=2038679)
- [https://www.mozilla.org/security/advisories/mfsa2026-45/](https://www.mozilla.org/security/advisories/mfsa2026-45/)

## Related threats

- [Firefox privilege escalation in Nimbus Desktop Client](https://junglewise.ai/threats/cve-2026-124951-privilege-escalation-in-the-nimbus-desktop-client-component-this)
- [Firefox same-origin policy bypass in CSS Parsing and Computation](https://junglewise.ai/threats/cve-2026-124950-same-origin-policy-bypass-in-the-css-parsing-and-computation)
- [Firefox other issue in SVG component](https://junglewise.ai/threats/cve-2026-124949-other-issue-in-the-svg-component-this-vulnerability-was-fixed-in)
- [Mozilla Firefox use-after-free in Graphics component](https://junglewise.ai/threats/cve-2026-124948-incorrect-boundary-conditions-use-after-free-in-the-graphics)
- [Firefox incorrect boundary conditions in Graphics component](https://junglewise.ai/threats/cve-2026-124947-incorrect-boundary-conditions-in-the-graphics-component-this)