CVE-2026-8953 is a use-after-free vulnerability in the Disability Access APIs component of Mozilla Firefox that enables sandbox escape. This memory safety bug could allow an attacker to execute code outside the browser sandbox, compromising the security boundary. The issue affects Firefox versions prior to 151 and corresponding ESR and Thunderbird versions. Mozilla has addressed this vulnerability with official fixes in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. The vulnerability carries a CVSS 3.1 base score of 9.6, reflecting critical impact on confidentiality, integrity, and availability. Vendor advisories confirm the fix and recommend upgrading to the patched versions.

Successful exploitation of this use-after-free vulnerability can lead to sandbox escape, allowing attackers to execute arbitrary code with elevated privileges outside the browser sandbox. This compromises the security model of Firefox and can lead to full system compromise. The CVSS score of 9.6 indicates critical impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported, but the vulnerability is considered severe due to its potential impact.

Mozilla has released official patches fixing this vulnerability in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. Users and administrators should upgrade to these versions or later to remediate the issue. Patch status is confirmed by Mozilla advisories. No additional mitigation actions are required beyond applying the official updates.