CVE-2026-0881

Sandbox escape in the Messaging System component

Critical · published January 13, 2026

CVSS v3.1
10.0
EPSS
0%
Percentile
27.2
In the wild
Unconfirmed
What it is

🚨 A crafty sandbox escape in the Messaging System can let attackers break free and access sensitive data — and it’s all thanks to a flaw in Firefox and Thunderbird! 🔥 Picture a hotel with a super secure room that guests can’t leave without permission. Now, imagine a guest finds a way to slip through the cracks and explore the staff-only areas — that’s what this vulnerability allows an attacker to do! If exploited, an attacker could gain unauthorized access to sensitive information and potentially execute malicious actions within the system. This is absolutely devastating, as it could compromise not just the affected user’s data, but also the integrity of the entire messaging platform. Your privacy could be at significant risk!

Put simply

Picture a hotel with a super secure room that guests can’t leave without permission. Now, imagine a guest finds a way to slip through the cracks and explore the staff-only areas — that’s what this vulnerability allows an attacker to do! This vulnerability in the Messaging System allows a sandbox escape, enabling arbitrary code execution outside the intended secure environment, which poses a severe security risk to users.

What to do

If exploited, an attacker could gain unauthorized access to sensitive information and potentially execute malicious actions within the system. This is absolutely devastating, as it could compromise not just the affected user’s data, but also the integrity of the entire messaging platform. Your privacy could be at significant risk! Update Firefox and Thunderbird to version 147 immediately to close this critical vulnerability. Ensure that any extensions or add-ons are also reviewed for potential security weaknesses. Regularly audit your applications to stay ahead of future threats. You've got this! By following these steps, you'll protect your data and become a security hero! 🦸‍♂️

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00348 · 27.2th percentile
Published
2026-01-13T13:30Z
EPSS history
Timeline
  • 13 JAN 13:30Z
    Sandbox escape in the Messaging System component
    cvelistv5