Sandbox Escape Vulnerability in Firefox Web Browser by Mozilla
CVE-2026-0878

8HIGH

Key Information:

Vendor

Mozilla
Status
Firefox
Firefox Esr
Thunderbird
Vendor
CVE Published:
13 January 2026

What is CVE-2026-0878?

A vulnerability exists in the Graphics: CanvasWebGL component of the Firefox web browser, allowing attackers to escape the sandbox due to incorrect boundary conditions. This can potentially lead to unauthorized access or manipulation of the system. It affects users running Firefox versions below 147 and Firefox Extended Support Release (ESR) versions below 140.7.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Firefox < 147

Firefox ESR < 140.7

Thunderbird < 147

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2003989
https://www.mozilla.org/security/advisories/mfsa2026-01/
https://www.mozilla.org/security/advisories/mfsa2026-03/

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Oskar L
JSON
.