CVE-2026-2780 is a privilege escalation vulnerability affecting the Netmonitor component in Mozilla Firefox. The vulnerability allows an attacker to gain elevated privileges within the browser context. It is classified under CWE-269 (Improper Privilege Management). The issue was resolved in Firefox 148 and Firefox ESR 140.8. Mozilla's official security advisories list this vulnerability among multiple high-impact bugs fixed in these releases. The CVSS v3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to escalate privileges within the Firefox browser environment, potentially leading to unauthorized actions or access. The high CVSS score indicates significant impact on confidentiality, integrity, and availability. However, there are no known exploits in the wild at the time of disclosure. The vulnerability affects Firefox versions prior to 148 and ESR versions prior to 140.8.

Mozilla has released official fixes for this vulnerability in Firefox 148 and Firefox ESR 140.8. Users and administrators should upgrade to these or later versions to remediate the issue. Since this is not a cloud service, remediation depends on applying the vendor-supplied updates. There are no indications from the vendor advisory that additional mitigations or workarounds are necessary beyond upgrading.