CVE-2026-0878 is a sandbox escape vulnerability caused by incorrect boundary conditions in the Graphics: CanvasWebGL component of Mozilla Firefox. This vulnerability could allow an attacker to bypass sandbox restrictions, potentially leading to arbitrary code execution or other high-impact consequences. The issue was addressed and fixed in Firefox 147 and Firefox ESR 140.7, as well as corresponding Thunderbird versions. The CVSS v3.1 base score is 8.0, reflecting high impact with network attack vector, high complexity, no privileges required, user interaction required, scope changed, and high confidentiality and integrity impacts but no availability impact.

Successful exploitation of this vulnerability could allow an attacker to escape the Firefox sandbox, potentially leading to arbitrary code execution with the privileges of the user running the browser. This compromises the confidentiality and integrity of the system. The vulnerability does not impact availability. No exploits in the wild have been reported so far.

A fix is available and has been officially released by Mozilla. Users and administrators should update affected Firefox versions to Firefox 147 or later, or Firefox ESR 140.7 or later. Corresponding Thunderbird versions have also been patched. Applying these official updates fully mitigates the vulnerability.