CVE-2026-8945 is a sandbox escape vulnerability in Mozilla Firefox and Firefox Focus for Android. The sandbox escape flaw allows an attacker to bypass the browser's security sandbox, which is designed to isolate web content and limit the impact of malicious code. This vulnerability was fixed in Firefox 151, as documented in the Mozilla Foundation Security Advisory MFSA 2026-46. The advisory rates the impact as high, indicating a significant security risk if exploited. No CVSS score is provided. The vulnerability was reported by Daisuke Hatakeyama and is part of a set of multiple security fixes released in Firefox 151.

The vulnerability enables an attacker to escape the sandbox environment in Firefox and Firefox Focus for Android, potentially allowing execution of code with higher privileges than intended by the sandbox. This could lead to compromise of the user's system or data. The vendor rates the impact as high. There are no reports of active exploitation in the wild at the time of disclosure.

Mozilla has fixed this vulnerability in Firefox version 151. Users and administrators should update to Firefox 151 or later to remediate this issue. Since this is a client-side application vulnerability, applying the official update is the recommended and effective mitigation. No additional vendor-recommended mitigations or workarounds are indicated in the advisory.