CVE-2026-8401 is a sandbox escape vulnerability affecting the Profile Backup component in Mozilla Firefox. This vulnerability could allow an attacker to escape the sandbox protections, potentially leading to arbitrary code execution or other high-impact consequences. The issue was addressed and fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11. The vulnerability has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is remotely exploitable without privileges or user interaction and can cause complete confidentiality, integrity, and availability compromise. The Mozilla security advisories mfsa2026-45 and mfsa2026-47 provide official confirmation of the fix and additional context on related vulnerabilities.

Successful exploitation of this vulnerability could allow an attacker to escape the sandbox environment in Firefox, potentially leading to arbitrary code execution with the privileges of the user running Firefox. This could compromise confidentiality, integrity, and availability of the affected system. The vulnerability is rated critical with a CVSS score of 9.8, reflecting its severe impact and ease of exploitation.

A fix is available and has been officially released by Mozilla. Users and administrators should update to Firefox 150.0.3 or later, Firefox ESR 115.36 or later, Firefox ESR 140.11 or later, or Thunderbird 140.11 or later to remediate this vulnerability. No additional mitigation actions are required beyond applying these updates.