Introduction
A buffer overflow in Firefox ESR's WebRTC Networking component lets a remote attacker escape the browser sandbox with no privileges required. CISA ADP scored it 9.6 on CVSS. For organizations that run Firefox ESR in managed or enterprise environments, this vulnerability (CVE-2026-7321) is a direct path from a malicious webpage to code execution outside the browser's security boundary.
Technical information
The root cause of CVE-2026-7321 is incorrect boundary conditions in the WebRTC Networking component of Firefox ESR. The vulnerability is classified under CWE-120: Buffer Copy without Checking Size of Input, commonly known as a Classic Buffer Overflow. The WebRTC networking code does not properly validate the size of input data before copying it into a fixed-size buffer, so an attacker can write beyond the allocated memory region.
CVSS vector breakdown
CISA ADP assigned the CVSS 3.1 vector string AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. Each part describes the attack surface:
- Attack Vector: Network. Exploitation happens remotely, likely through a malicious webpage or WebRTC session.
- Attack Complexity: Low. No special conditions or race windows are needed.
- Privileges Required: None. The attacker does not need any authentication.
- User Interaction: Required. A victim must visit a malicious page or otherwise engage with attacker-controlled content.
- Scope: Changed. The vulnerability affects resources beyond the vulnerable component's security authority. Here, the buffer overflow in the WebRTC networking code lets the attacker break out of the browser sandbox entirely and reach the underlying operating system or other processes.
The impact ratings are High for Confidentiality, Integrity, and Availability.
Severity discrepancy
The sources disagree on severity. The NVD, using CISA ADP data, rates this as CRITICAL with a 9.6 score. Mozilla's own advisory (MFSA 2026-36) classifies the impact as moderate. This kind of divergence is not unusual. Vendors sometimes rate based on practical exploitability or internal threat modeling, while NVD scoring follows a more formulaic approach tied to the CVSS vector. For defensive planning, we recommend taking the higher rating seriously because of the sandbox escape capability.
Attack flow
Based on the CVSS vector and the vulnerability's characteristics, exploitation would likely proceed as follows:
- An attacker crafts a malicious webpage or WebRTC session that triggers the buffer overflow in the WebRTC Networking component.
- A victim using a vulnerable version of Firefox ESR navigates to the attacker-controlled content or is redirected to it.
- The malicious input exceeds the expected buffer size in the WebRTC networking code and overwrites adjacent memory.
- The attacker uses the memory corruption to achieve code execution within the browser's content process.
- Because the scope is "Changed," the attacker uses this foothold to escape the browser sandbox and reach the host operating system with the privileges of the browser process.
A security researcher identified as Bugmon reported the vulnerability. The associated Bugzilla ticket (bug 2029461) is access restricted, so no crash logs, stack traces, or other technical details are publicly available.
Affected systems and versions
| Product | Status | Version |
|---|---|---|
| Mozilla Firefox ESR | Vulnerable | All versions prior to 140.10.1 |
| Mozilla Firefox ESR | Fixed | 140.10.1 and later |
Administrators should check their software inventory and confirm that no vulnerable Firefox ESR versions are still running in their environments.
Vendor security history
Mozilla's security program is mature and active. Mozilla runs a dedicated Bug Bounty Program through HackerOne to encourage independent security research and responsible disclosure. It consistently publishes Foundation Security Advisories to disclose vulnerabilities openly, and it ships patches promptly. Firefox ESR is built for organizations that need extended support cycles, which makes prompt patching of critical vulnerabilities especially important for its users. As of March 2026, Firefox holds approximately 2.33 percent of the global desktop browser market. That share is modest, but its concentration in enterprise and managed deployments makes vulnerabilities like CVE-2026-7321 more relevant than the number suggests.
