CVE-2026-8401: Sandbox escape in the Profile Backup component
Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 150.0.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 115.36 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 140.11 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 150.0.3 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 115.36 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 140.11 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 140.11
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2026-8401?
CVE-2026-8401 is rated as a high severity vulnerability due to its potential for sandbox escape.
How do I fix CVE-2026-8401?
To fix CVE-2026-8401, ensure that you update Firefox to version 150.0.3 or higher.
Who is affected by CVE-2026-8401?
CVE-2026-8401 affects users of Mozilla Firefox versions prior to 150.0.3.
What does CVE-2026-8401 involve?
CVE-2026-8401 involves a sandbox escape vulnerability in the Profile Backup component of Firefox.
When was CVE-2026-8401 disclosed?
CVE-2026-8401 was disclosed in the security advisory for Mozilla Firefox.