CVE-2026-8945 is a sandbox escape vulnerability in Mozilla Firefox and Firefox Focus for Android. It allows an attacker to break out of the browser's sandbox security mechanism, which is designed to isolate processes and limit the impact of exploits. The vulnerability was addressed and fixed in Firefox version 151. The CVSS v3.1 base score is 7.5, with network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The Mozilla advisory MFSA 2026-46 confirms the fix and provides additional context on related vulnerabilities fixed in the same release. There are no known exploits in the wild at this time.

Successful exploitation of this vulnerability could allow an attacker to escape the sandbox environment in Firefox or Firefox Focus for Android, potentially leading to arbitrary code execution with the privileges of the user running the browser. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability is rated high severity with a CVSS score of 7.5. No known active exploits have been reported.

This vulnerability is fixed in Mozilla Firefox version 151. Users and administrators should update affected Firefox installations to version 151 or later to mitigate this issue. There is no indication that additional mitigation steps are required beyond applying the official update. Patch status is confirmed by the Mozilla advisory MFSA 2026-46.