CVE-2026-0879 is a critical security vulnerability in Mozilla Firefox involving a sandbox escape due to incorrect boundary conditions in the Graphics component. The flaw allows an attacker to bypass sandbox restrictions, potentially leading to arbitrary code execution with high impact on confidentiality, integrity, and availability. Mozilla addressed this issue in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. The vulnerability is tracked under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The vendor advisory confirms the fix and recommends upgrading to the patched versions.

Successful exploitation of this vulnerability could allow an attacker to escape the sandbox environment in Firefox, potentially leading to arbitrary code execution with full system privileges. The CVSS 3.1 base score of 9.8 reflects critical impact on confidentiality, integrity, and availability. There are no known exploits in the wild currently, but the vulnerability poses a high risk if left unpatched.

Mozilla has released official fixes for this vulnerability in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. Users and administrators should upgrade to these versions or later to remediate the vulnerability. No additional mitigation steps are required beyond applying the official patches.