CVE-2026-2777 is a privilege escalation vulnerability in the Messaging System component of Mozilla Firefox. This vulnerability allows an attacker to gain elevated privileges, potentially compromising the security context of the application. It affects Firefox versions prior to 148 and Firefox ESR versions prior to 115.33. The vulnerability was addressed and fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. The CVSS v3.1 base score is 9.8, reflecting critical impact with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor advisory confirms the availability of patches and recommends updating to fixed versions.

Successful exploitation of this vulnerability could allow an attacker to escalate privileges within the Firefox Messaging System component, potentially leading to full compromise of the affected application. The CVSS score of 9.8 indicates critical impact affecting confidentiality, integrity, and availability. There are no known exploits in the wild at the time of this advisory.

Mozilla has released official patches fixing this vulnerability in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Users and administrators should update affected software to these versions or later to remediate the vulnerability. No additional mitigation steps are indicated beyond applying the official updates.