CVE-2026-0881 is a sandbox escape vulnerability in the Messaging System component of Mozilla Firefox. It was reported by Andrew McCreight and fixed in Firefox 147 and Thunderbird 147. The vulnerability allows an attacker to escape the sandbox environment, which is designed to isolate potentially malicious code, thereby potentially enabling arbitrary code execution with elevated privileges. The CVSS v3.1 base score is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating a critical remote code execution vulnerability with no required privileges or user interaction and complete impact on confidentiality, integrity, and availability. The vendor advisory confirms the fix is included in Firefox 147 and Thunderbird 147 releases.

Successful exploitation of this vulnerability could allow an attacker to escape the sandbox in Firefox, leading to arbitrary code execution with high privileges. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability is critical due to its high CVSS score and the nature of sandbox escapes, which undermine core security protections.

Mozilla has released official fixes for this vulnerability in Firefox 147 and Thunderbird 147. Users and administrators should update affected products to these versions or later to remediate the issue. No additional mitigations are required beyond applying the official update. Patch status is confirmed by Mozilla advisories MFSA 2026-01 and MFSA 2026-04.