CVE-2026-7321
Sandbox Escape in Firefox WebRTC Networking Component
Publication date: 2026-04-28
Last updated on: 2026-05-01
Assigner: Mozilla Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mozilla | firefox | to 150.0 (exc) |
| mozilla | thunderbird | to 150.0 (exc) |
| mozilla | firefox | to 140.10.1 (exc) |
| mozilla | thunderbird | to 140.10.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-7321 is a security vulnerability in the WebRTC Networking component of Firefox ESR that allows a sandbox escape due to incorrect boundary conditions.
A sandbox escape means that an attacker can break out of the restricted environment (sandbox) that is designed to isolate processes and limit the impact of exploits.
This flaw was fixed in Firefox ESR version 140.10.1 by correcting the boundary condition errors to prevent unauthorized access beyond the sandbox restrictions.
How can this vulnerability impact me? :
This vulnerability can have a severe impact because it allows an attacker to escape the sandbox environment, potentially gaining unauthorized access to system resources.
The CVSS score of 9.6 indicates a critical severity with high impact on confidentiality, integrity, and availability.
An attacker exploiting this flaw could execute arbitrary code or access sensitive information beyond the intended sandbox restrictions.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update Firefox ESR to version 140.10.1 or later, where the issue has been fixed.
This update corrects the incorrect boundary conditions in the WebRTC Networking component that allowed sandbox escape.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.