CVE-2026-2768Disclosure(mozilla / firefox)

MEDIUMCVSS 10.0 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch mozilla firefox systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Sandbox escape in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

mozilla CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-284CWE-693

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

firefox
thunderbird

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
7 mentions across 6 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 1 signal
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 2 signals
Technical details provided in 6 signals
Disclosure: 4 classified signals
Peaked 5d ago at 2 mentions (2026-02-25); latest day: 1
7 total mentions across 6 days

Affected systems

Vendors

mozilla

Products

firefoxthunderbird

Deep dive

Activity timeline7 mentions / 6d

Signal classification4 categories

Disclosure

457.1%

Patch

114.3%

PoC

114.3%

General

114.3%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-25	2	Disclosure2
2026-02-28	1	Disclosure1
2026-03-01	1	Disclosure1
2026-04-16	1	Patch1
2026-08-21	1	PoC1
2026-08-25	1	General1

Full discourse7 posts

dbugs@ptdbugs48d
PoC
A PoC/exploit has been discovered for vulnerability CVE-2026-2796 Vendor: Mozilla Product: Firefox Description: JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. Link: https://github.com/SneakyNachos/CVE-2026-2796-escape-wasm-by-using-wasm https://github.com/sneakynachos/cve-2026-2796-and-cve-2026-2768-escape-the-wasm-box #dbugs_vuln
Post summary
A PoC/exploit for CVE-2026-2796 has been released via GitHub, detailing a JIT miscompilation in WebAssembly, with vendors noting a fix in Firefox 148; no indication of active exploitation is reported.
08035133.5K
3.6K followersView on X
ExploitGrid@exploitgrid44d
General
🛡️ #ExploitGrid Daily #Threat Digest Critical Exploits disclosed today: #CVE-2025-55182 CVE-2026-2796 CVE-2026-2768 CVE-2026-34910 CVE-2026-34909 CVE-2026-58231 CVE-2026-48907 ..🧵👇
Post summary
The tweet lists several CVE identifiers in a daily threat digest format but does not provide any technical details, exploits, or remediation information.
11020167
365 followersView on X
Giuseppe Paternicola@giuseppe_1337175d
Patch
🚨 CRITICAL: CVE-2026-2768 | CVSS 10.0 Sandbox escape in Firefox/Thunderbird IndexedDB component. Network exploitable, no user interaction required. Patched in Firefox 148, ESR 140.8, Thunderbird 148/140.8. #CVE #PatchNow #ThreatIntel https://t.co/oFrkzlkx9r
Post summary
The tweet alerts to a critical CVE-2026-2768 sandbox escape in Firefox/Thunderbird IndexedDB that is network exploitable without user interaction, and announces that patches are available in Firefox 148, ESR 140.8, and Thunderbird 148/140.8, urging users to update immediately.
0000041
25 followersView on X
CRAC Learning - Tech@cracbot221d
Disclosure
CVE-2026-2768 (CVSS:10.0, CRITICAL) is Modified. Sandbox escape in the Storage: IndexedDB component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thund..https://nvd.nist.gov/vuln/detail/CVE-2026-2768 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post announces CVE-2026-2768, a critical sandbox escape in Firefox’s IndexedDB component affecting versions below 148 and ESR below 140.8, with no PoC or exploit details provided.
0000034
173 followersView on X
CRAC Learning - Tech@cracbot222d
Disclosure
CVE-2026-2768 (CVSS:10.0, CRITICAL) is Modified. Sandbox escape in the Storage: IndexedDB component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thund..https://nvd.nist.gov/vuln/detail/CVE-2026-2768 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post announces CVE-2026-2768, a sandbox escape vulnerability in Firefox’s IndexedDB component, providing severity, affected versions, and linking to the NVD entry.
0000050
173 followersView on X
Infoflowcloud@infoflowcloud225d
Disclosure
🚨*CVE* CVE-2026-2768 Sandbox escape in the Storage: IndexedDB component. This vulnerability affects Firefox < 148 and Firefox ESR < 140.8. https://www.cve.org/CVERecord?id=CVE-2026-2768 ----- Traducción: CVE-2026-2768 Escape de sandbox en el componente Storage: IndexedDB. E… http://infoflow.cloud`
Post summary
The text announces CVE-2026-2768, a sandbox escape vulnerability in Firefox’s IndexedDB component affecting versions below 148 and ESR below 140.8, with no mention of PoC, exploit, or patch.
0000052
54 followersView on X
CVE@CVEnew225d
Disclosure
CVE-2026-2768 Sandbox escape in the Storage: IndexedDB component. This vulnerability affects Firefox < 148 and Firefox ESR < 140.8. https://www.cve.org/CVERecord?id=CVE-2026-2768
Post summary
The text announces CVE-2026-2768, a sandbox escape vulnerability in Firefox’s IndexedDB component affecting versions below 148 and ESR below 140.8, with no PoC, exploit, or patch details provided.
00000714
56.6K followersView on X

CPE platform detail4 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

4 of 4 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	mozilla	firefox	-	-	-
App	mozilla	firefox	-	-	-
App	mozilla	thunderbird	-	-	-
App	mozilla	thunderbird	-	-	-

Explore more

Back to dashboard mozilla CVEs firefox vulnerabilities

What researchers are saying

CVE-2026-2768

dbugs[verified]@ptdbugsPoC

A PoC/exploit for CVE-2026-2796 has been released via GitHub, detailing a JIT miscompilation in WebAssembly, with vendors noting a fix in Firefox 148; no indication of active exploitation is reported.

Giuseppe Paternicola[verified]@giuseppe_1337Patch

The tweet alerts to a critical CVE-2026-2768 sandbox escape in Firefox/Thunderbird IndexedDB that is network exploitable without user interaction, and announces that patches are available in Firefox 148, ESR 140.8, and Thunderbird 148/140.8, urging users to update immediately.

ExploitGrid@exploitgridGeneral

The tweet lists several CVE identifiers in a daily threat digest format but does not provide any technical details, exploits, or remediation information.

CRAC Learning - Tech@cracbotDisclosure

The post announces CVE-2026-2768, a critical sandbox escape in Firefox’s IndexedDB component affecting versions below 148 and ESR below 140.8, with no PoC or exploit details provided.

CRAC Learning - Tech@cracbotDisclosure

The post announces CVE-2026-2768, a sandbox escape vulnerability in Firefox’s IndexedDB component, providing severity, affected versions, and linking to the NVD entry.

Infoflowcloud@infoflowcloudDisclosure

The text announces CVE-2026-2768, a sandbox escape vulnerability in Firefox’s IndexedDB component affecting versions below 148 and ESR below 140.8, with no mention of PoC, exploit, or patch.

CVE@CVEnewDisclosure

The text announces CVE-2026-2768, a sandbox escape vulnerability in Firefox’s IndexedDB component affecting versions below 148 and ESR below 140.8, with no PoC, exploit, or patch details provided.