CVE-2026-2768 is a sandbox escape vulnerability in the Storage: IndexedDB component of Mozilla Firefox. The flaw could allow an attacker to bypass sandbox restrictions, potentially leading to arbitrary code execution or other severe impacts. It is part of a set of high-impact vulnerabilities fixed in Firefox 148 and Firefox ESR 140.8. The vulnerability has a CVSS 3.1 base score of 10.0, indicating critical severity with network attack vector, no required privileges or user interaction, and impacts on confidentiality, integrity, and availability. Mozilla has released official patches addressing this issue.

The vulnerability enables sandbox escape in Firefox's IndexedDB storage component, which can lead to full compromise of the browser environment. The CVSS score of 10.0 reflects critical impact on confidentiality, integrity, and availability. Exploitation could allow attackers to execute arbitrary code or escalate privileges within the browser context. There are no known exploits in the wild at the time of the advisory.

Mozilla has released official fixes for this vulnerability in Firefox 148 and Firefox ESR 140.8. Users and administrators should update to these versions or later to remediate the issue. Since this is a client-side application vulnerability, applying the vendor's official update is the primary and recommended mitigation. No additional mitigation steps are indicated by the vendor advisory.