CVE-2026-2778 is a critical vulnerability in Mozilla Firefox's DOM: Core & HTML component caused by incorrect boundary conditions, leading to a sandbox escape. This flaw could allow an attacker to bypass sandbox restrictions, potentially executing arbitrary code or escalating privileges within the browser environment. The vulnerability has a CVSS v3.1 base score of 10.0, reflecting its critical impact and ease of exploitation. Mozilla addressed this issue in Firefox 148 and corresponding ESR and Thunderbird versions. The vendor advisory explicitly lists this vulnerability among multiple high-impact security fixes released simultaneously. No known active exploitation has been reported.

Successful exploitation of CVE-2026-2778 could allow an attacker to escape the browser sandbox, potentially leading to arbitrary code execution with the privileges of the user running Firefox. This compromises confidentiality, integrity, and availability of the affected system. Given the critical CVSS score of 10.0, the impact is severe. However, no known exploits in the wild have been reported at the time of disclosure.

An official fix is available and has been released by Mozilla in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Users and administrators should update to these versions or later to remediate this vulnerability. There are no vendor indications that additional mitigation steps are required beyond applying the update.