CVE-2026-0879 is a memory safety vulnerability classified under CWE-119, involving incorrect boundary conditions in the Graphics component of Mozilla Firefox. This flaw enables sandbox escape, which could allow an attacker to execute arbitrary code outside the browser's sandbox. The vulnerability was reported by Oskar L and fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. The CVSS v3.1 base score is 9.8 (critical), with attack vector network, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. Multiple Mozilla security advisories (MFSA2026-01 and MFSA2026-02) and Red Hat errata provide additional context and patch information.

Successful exploitation of this vulnerability could allow an attacker to escape the Firefox sandbox, potentially leading to arbitrary code execution with the privileges of the user running the browser. This compromises confidentiality, integrity, and availability of the affected system. Given the critical CVSS score and the nature of the sandbox escape, the impact is severe.

Mozilla has released official patches fixing this vulnerability in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. Users and administrators should upgrade to these versions or later to mitigate the risk. There are no known exploits in the wild, but timely patching is strongly recommended. Refer to Mozilla security advisories MFSA2026-01 and MFSA2026-02 for detailed patch information and guidance.