CVE-2026-2777 is a privilege escalation vulnerability found in the Messaging System component of Mozilla Firefox and Thunderbird. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. The CVSS 3.1 base score is 9.8, reflecting a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. The vendor advisory confirms the vulnerability is addressed in the stated versions. No exploits are currently known in the wild. This vulnerability is part of a larger set of high-impact security fixes released simultaneously by Mozilla.

Successful exploitation of CVE-2026-2777 could allow an attacker to escalate privileges within the Messaging System component, potentially leading to unauthorized access or control over the affected Firefox or Thunderbird application. The critical CVSS score of 9.8 indicates a severe impact on confidentiality, integrity, and availability. However, no known exploits have been reported in the wild at the time of disclosure.

Mozilla has released official fixes for this vulnerability in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Users and administrators should update to these versions or later to remediate the vulnerability. Patch status is confirmed by the vendor advisory. No additional mitigation actions are required beyond applying the official updates.