CVE-2026-2782

Privilege escalation in the Netmonitor component

State: Published
Severity: 8.8 High
Published: Feb 24, 2026
Updated: Apr 13, 2026
Reserved: Feb 19, 2026

Description

Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-269 Improper Privilege Management

Affected Products

Product	Versions
FirefoxMozilla	140.8 through 140.*Not affected 148 and laterNot affected
ThunderbirdMozilla	140.8 through 140.*Not affected 148 and laterNot affected

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2010743
https://www.mozilla.org/security/advisories/mfsa2026-13/
https://www.mozilla.org/security/advisories/mfsa2026-15/
https://www.mozilla.org/security/advisories/mfsa2026-16/
https://www.mozilla.org/security/advisories/mfsa2026-17/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.