CVE-2026-2778 is a sandbox escape vulnerability in Mozilla Firefox resulting from incorrect boundary conditions in the DOM: Core & HTML component. This flaw allows an attacker to bypass sandbox restrictions, potentially leading to arbitrary code execution or full system compromise. The issue was addressed and fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. The vulnerability has a CVSS v3.1 base score of 10.0, reflecting its critical impact and ease of exploitation without privileges or user interaction. The Mozilla advisories confirm the fix and recommend upgrading to the patched versions.

Successful exploitation of this vulnerability can lead to sandbox escape, allowing an attacker to execute arbitrary code with elevated privileges outside the browser sandbox. This results in complete compromise of confidentiality, integrity, and availability of the affected system. The CVSS score of 10.0 indicates a critical impact with network attack vector and no required privileges or user interaction.

Mozilla has released official fixes for this vulnerability in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Users and administrators should upgrade to these versions or later to remediate this issue. No additional mitigation is required once the update is applied.