CVE-2026-2768: mozilla firefox Improper Access Control
CVSS: 10.0v3.1CriticalModified
AliasesUBUNTU-CVE-2026-2768DEBIAN-CVE-2026-2768CGA-vfgp-77fr-rqpwCGA-w4m7-wq2m-mp5fCGA-qq3m-fp7v-m848CGA-vp76-822w-3wv9
Published 24-02-2026Last modified 15-07-2026
Vulnerability summary
CVE-2026-2768 is a critical (CVSS 10.0) Improper Access Control vulnerability in mozilla firefox. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 46.7% of scored vulnerabilities.
CVSS score
10.0/10
010
Critical · v3.1 (CVE.org)EPSS score
0.58%
0%100%
Low · +0.21 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 39 · Related 9DLA-4495-1DLA-4496-1DSA-6148-1DSA-6152-1MGASA-2026-0052MGASA-2026-0053OPENSUSE-SU-2026:10242-1OPENSUSE-SU-2026:10248-1OPENSUSE-SU-2026:10257-1OPENSUSE-SU-2026:20365-1OPENSUSE-SU-2026:20391-1RHSA-2026:3338RHSA-2026:3339RHSA-2026:3361RHSA-2026:3491RHSA-2026:3492RHSA-2026:3493RHSA-2026:3494RHSA-2026:3495RHSA-2026:3496RHSA-2026:3497RHSA-2026:3515RHSA-2026:3516RHSA-2026:3517RHSA-2026:3976RHSA-2026:3978RHSA-2026:3979RHSA-2026:3980RHSA-2026:3981RHSA-2026:3982RHSA-2026:3983RHSA-2026:3984RHSA-2026:4022RHSA-2026:4152RHSA-2026:4260RHSA-2026:4432SUSE-SU-2026:0812-1SUSE-SU-2026:0871-1SUSE-SU-2026:0880-1CGA-F37V-9JMM-G6GP
Timeline
- 24-02-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
Sandbox escape in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVSS metrics
6 scores · 6 sources · 1 versionCritical 10.0Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HSources6 sources · 7.5–10.0
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HDiffers
- OSV · DebianEcosystem advisory · calculated10.0CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated10.0CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- NVDNIST10.0CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated10.0CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.58%
Chance of exploitation in the next 30 days
Percentile
47%
Versus all other CVEs
30-day change
+0.21 pp
From 0.37% on 20-09-2026
20-09-202620-10-2026
EPSS score0.58%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-693Protection Mechanism FailureThe product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Affected systems
Ubuntu8 products
- mozjs102All versions (No fix recorded)
- mozjs115All versions (No fix recorded)
- mozjs38All versions (No fix recorded)
- mozjs52All versions (No fix recorded)
- mozjs68All versions (No fix recorded)
Chainguard2 products
- firefox< 148.0-r0
- firefox-esr< 140.8.0-r0
Debian2 products
- firefox-esr< 140.8.0esr-1~deb12u1 | < 140.8.0esr-1~deb13u1 | < 140.8.0esr-1
- thunderbird< 1:140.8.0esr-1~deb12u1 | < 1:140.8.0esr-1~deb13u1 | < 1:140.8.0esr-1
Mozilla2 products
- firefox< 140.8.0 | < 148.0
- thunderbird< 140.8.0 | < 148.0
Wolfi1 product
- firefox< 148.0-r0
5 vendors · 15 products
