CVE-2026-2768 is a sandbox escape vulnerability in the Storage: IndexedDB component of Mozilla Firefox. The flaw allows an attacker to bypass sandbox restrictions, potentially enabling arbitrary code execution with elevated privileges. This vulnerability was addressed and fixed in Firefox 148 and Firefox ESR 140.8. The CVSS v3.1 base score is 10.0, reflecting a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. The Mozilla Foundation released official security advisories MFSA 2026-13 and MFSA 2026-15 detailing this and other related vulnerabilities fixed in these versions.

Successful exploitation of this vulnerability could allow an attacker to escape the sandbox environment in Firefox, leading to arbitrary code execution with high privileges on the affected system. The impact includes full compromise of confidentiality, integrity, and availability of the affected system. Given the CVSS score of 10.0, this represents a critical security risk. No active exploits have been reported in the wild as of the advisory date.

Mozilla has released official fixes for this vulnerability in Firefox 148 and Firefox ESR 140.8. Users and administrators should update affected Firefox installations to version 148 or later, or Firefox ESR 140.8 or later, to remediate this issue. No additional mitigation steps are required beyond applying the official update.