CVE-2026-2776 is a sandbox escape vulnerability due to incorrect boundary conditions in the Telemetry component within External Software in Mozilla Firefox. This vulnerability allows an attacker to escape the sandbox protections, potentially leading to arbitrary code execution or other high-impact consequences. The issue was addressed and fixed in Firefox version 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird ESR 140.8. The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The CVSS v3.1 base score is 10.0, reflecting critical impact with network attack vector, no privileges or user interaction required, and complete compromise of confidentiality, integrity, and availability. Mozilla has officially fixed this vulnerability in the stated versions.

Successful exploitation of this vulnerability allows an attacker to escape the sandbox environment in Firefox, which can lead to arbitrary code execution with elevated privileges, complete compromise of the affected system's confidentiality, integrity, and availability. The CVSS score of 10.0 indicates the highest level of severity and impact. There are no known exploits in the wild at the time of the advisory.

Mozilla has released official fixes for this vulnerability in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird ESR 140.8. Users and administrators should update to these versions or later to remediate the vulnerability. No additional mitigations are required beyond applying the official patches.