CVE-2026-0881 is a sandbox escape vulnerability affecting the Messaging System component in Mozilla Firefox and Thunderbird. The flaw allows an attacker to bypass sandbox restrictions, which are designed to isolate potentially malicious code and limit its access to the system. This vulnerability was addressed and fixed in Firefox 147 and Thunderbird 147 releases. The vulnerability carries a CVSS v3.1 base score of 10.0, reflecting its critical impact and ease of exploitation without user interaction or privileges. The Mozilla security advisories MFSA2026-01 and MFSA2026-04 provide detailed information and confirm the fix in the specified versions.

Successful exploitation of this vulnerability could allow an attacker to escape the sandbox environment, potentially leading to arbitrary code execution with elevated privileges, full system compromise, and complete loss of confidentiality, integrity, and availability. The vulnerability is rated critical with a CVSS score of 10.0. No known exploits in the wild have been reported as of the advisory date.

This vulnerability has been fixed in Firefox 147 and Thunderbird 147. Users and administrators should update to these versions or later to mitigate the risk. No additional mitigation actions are required beyond applying the official updates. Patch status is confirmed by Mozilla advisories MFSA2026-01 and MFSA2026-04.