CVE-2026-8401: Sandbox escape in the Profile Backup component
Published May 12, 2026
·Updated
Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
Affected Software
6 affected componentsFixes available
Mozilla Firefox<150.0.3
Mozilla Firefox<150.0.3
150.0.3
Mozilla Firefox ESR<115.36
115.36
Mozilla Firefox ESR<140.11
140.11
Mozilla Firefox<150.0.3
Mozilla Thunderbird<140.11
140.11
Event History
May 12, 2026
CVE Published
via Mozilla·12:00 AM
Data Sourced
via Mozilla·12:00 AM
DescriptionSeverityAffected Software
CVE Published
via MITRE·02:24 PM
Data Sourced
via MITRE·02:24 PM
Description
Data Sourced
via NVD·03:16 PM
DescriptionSeverityWeaknessAffected Software
May 19, 2026
Updated
via Mozilla·12:00 AM
Affected Software
Apr 22, 58353
Event
via FIRST·06:30 AM
Frequently Asked Questions
1
What is the severity of CVE-2026-8401?
CVE-2026-8401 is rated as a high severity vulnerability due to its potential for sandbox escape.
2
How do I fix CVE-2026-8401?
To fix CVE-2026-8401, ensure that you update Firefox to version 150.0.3 or higher.
3
Who is affected by CVE-2026-8401?
CVE-2026-8401 affects users of Mozilla Firefox versions prior to 150.0.3.
4
What does CVE-2026-8401 involve?
CVE-2026-8401 involves a sandbox escape vulnerability in the Profile Backup component of Firefox.
5
When was CVE-2026-8401 disclosed?
CVE-2026-8401 was disclosed in the security advisory for Mozilla Firefox.