CVE-2026-8959 is a sandbox escape vulnerability due to incorrect boundary conditions in the Widget: Win32 component of Mozilla Firefox. This flaw allows code executing within the sandbox to potentially break out of its restricted environment. The vulnerability was reported by Ameen Basha M K and is classified with moderate impact by Mozilla. It was fixed in Firefox 151 and Firefox ESR 140.11 as part of a broader security update addressing multiple vulnerabilities. The vendor advisories confirm the fix and recommend updating to these versions.

The vulnerability enables sandbox escape, which could allow an attacker to bypass security restrictions imposed by the sandbox environment. This could lead to privilege escalation or arbitrary code execution outside the sandbox. However, the impact is rated moderate by Mozilla, and no known exploits in the wild have been reported. The fix prevents potential exploitation by correcting the boundary condition errors in the Widget: Win32 component.

Mozilla has released official fixes for this vulnerability in Firefox 151 and Firefox ESR 140.11. Users and administrators should update to these versions or later to remediate the issue. Since this is not a cloud service, remediation depends on applying these updates. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching.