Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.6

Firefox ESR: WebRTC bug allows hackers to escape browser sandbox

CVE-2026-7321 · published 6 months ago
Summary

A bug in Firefox's WebRTC feature allows hackers to break out of the browser's security sandbox, potentially enabling malicious activities. This issue has been fixed in the latest version of Firefox ESR 140.10.1, so make sure to update your browser to this version to stay protected. If you haven't updated already, do so as soon as possible to prevent potential security risks.

What to do
  • Update debian firefox-esr to version 140.10.1esr-1~deb12u1.
  • Update debian firefox-esr to version 140.10.1esr-1~deb13u1.
  • Update debian firefox-esr to version 140.10.1esr-1~deb11u1.
Affected software
Ecosystem VendorProductAffected versions
Debian:11 debian firefox-esr < 140.10.1esr-1~deb11u1
Fix: upgrade to 140.10.1esr-1~deb11u1
Debian:12 debian firefox-esr < 140.10.1esr-1~deb12u1
Fix: upgrade to 140.10.1esr-1~deb12u1
Debian:13 debian firefox-esr < 140.10.1esr-1~deb13u1
Fix: upgrade to 140.10.1esr-1~deb13u1
Debian:14 debian firefox-esr All versions
Original advisory text
Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, and Thunderbird 140.10.1.
Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, and Thunderbird 140.10.1.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.6 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-120Classic Buffer Overflow
Timeline
Published28 Apr 2026
Updated4 Nov 2026
First seen28 Apr 2026
Sources
CVE-2026-7321 · NVD
DEBIAN-CVE-2026-7321 · OSV
Track software like this
Free during beta