CVE-2026-0880 is a sandbox escape vulnerability due to an integer overflow in the Graphics component of Mozilla Firefox. The flaw allows an attacker to bypass sandbox restrictions, potentially leading to arbitrary code execution or other high-impact consequences. This vulnerability was addressed and fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. The CVSS v3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to escape the browser sandbox, potentially leading to arbitrary code execution with the privileges of the user running the browser. This impacts confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported, but the high CVSS score and sandbox escape nature indicate a serious security risk if unpatched.

This vulnerability has been fixed by Mozilla in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. Users and administrators should update to these versions or later to mitigate the risk. Since this is not a cloud service, remediation depends on applying these official vendor patches. Patch status is confirmed by the Mozilla security advisories mfsa2026-01 and mfsa2026-02.