CVE-2026-8953 is a sandbox escape vulnerability caused by a use-after-free bug in the Disability Access APIs component of Mozilla Firefox. This type of vulnerability can allow code running inside the browser sandbox to break out of its restricted environment, potentially leading to privilege escalation or arbitrary code execution. Mozilla fixed this issue in Firefox 151 and the corresponding ESR releases 115.36 and 140.11. The vulnerability is rated as moderate impact by the vendor, and no active exploitation has been reported.

The vulnerability enables sandbox escape, which could allow an attacker to bypass security restrictions imposed by the Firefox sandbox. This could lead to increased privileges or execution of arbitrary code outside the sandbox. However, the impact is assessed as moderate by Mozilla, indicating that while serious, it may require specific conditions or user interaction to exploit. There are no known exploits in the wild at this time.

A fix for this vulnerability is available and has been incorporated into Firefox 151, Firefox ESR 115.36, and Firefox ESR 140.11. Users and administrators should update to these versions or later to remediate the issue. No additional mitigation actions are required beyond applying the official update.