CVE-2026-0879

Sandbox escape due to incorrect boundary conditions in the Graphics component

Critical · published January 13, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
41.9
In the wild
Unconfirmed
What it is

🔥 A sneaky boundary condition flaw in the Graphics component could let attackers escape the sandbox, breaking through the barriers like a magician slipping out of handcuffs! 🎩✨ Think of the sandbox as a play area for kids, designed to keep them in a safe zone. This vulnerability is like discovering a hidden hole that allows a child to sneak out and venture into the street, where they could potentially get into all sorts of trouble! If exploited, this vulnerability would allow an attacker to execute arbitrary code outside the sandbox, putting user data and system integrity at risk. It's a critical breach that could lead to full system compromise, exposing sensitive information and allowing attackers to take control of the device. Absolutely devastating!

Put simply

Think of the sandbox as a play area for kids, designed to keep them in a safe zone. This vulnerability is like discovering a hidden hole that allows a child to sneak out and venture into the street, where they could potentially get into all sorts of trouble! This sandbox escape vulnerability arises from incorrect boundary conditions in the Graphics component, allowing unauthorized access to system resources. Specifically, it allows malicious code to run outside the intended secure environment of the application.

What to do

If exploited, this vulnerability would allow an attacker to execute arbitrary code outside the sandbox, putting user data and system integrity at risk. It's a critical breach that could lead to full system compromise, exposing sensitive information and allowing attackers to take control of the device. Absolutely devastating! To protect yourself, update to Firefox version 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, or Thunderbird 140.7 immediately. Ensuring your software is up-to-date is key to maintaining security. Don't forget to check if other plugins or extensions might also need updates! You've got this! With these simple updates, you'll secure your system in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00500 · 41.9th percentile
Published
2026-01-13T13:30Z
EPSS history
Timeline
  • 13 JAN 13:30Z
    Sandbox escape due to incorrect boundary conditions in the Graphics component
    cvelistv5