CVE-2026-2776 is a critical security vulnerability in Mozilla Firefox's Telemetry component, where incorrect boundary conditions allow sandbox escape. This vulnerability enables an attacker to bypass the sandbox protections, potentially leading to arbitrary code execution with high impact on confidentiality, integrity, and availability. The issue is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). Mozilla addressed this vulnerability in Firefox 148 and corresponding ESR and Thunderbird versions. The CVSS v3.1 base score is 10.0, reflecting a network attack vector with no privileges or user interaction required, and a complete system compromise impact. The vendor advisory explicitly states the fix availability and urges users to update to the patched versions.

Successful exploitation of this vulnerability could allow an attacker to escape the sandbox environment in Firefox, potentially leading to arbitrary code execution with full system privileges. The impact includes complete compromise of confidentiality, integrity, and availability of the affected system. No known exploits are reported in the wild at the time of disclosure.

Mozilla has released official fixes for this vulnerability in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Users and administrators should update to these versions or later to remediate the vulnerability. No additional mitigation steps are required beyond applying the official patches.