Back to overview

CVE-2026-0881

CRITICAL
10.0
CVSS 3.1
Description
Sandbox escape in the Messaging System component. This vulnerability was fixed in Firefox 147 and Thunderbird 147.

Metadata

CVE ID
CVE-2026-0881
State
PUBLISHED
Assigner
mozilla
Reserved
2026-01-13 13:30 UTC
Published
2026-01-13 13:30 UTC
Last updated
2026-07-15 01:23 UTC
Primary CWE
CWE-693
CWE-693 Protection Mechanism Failure
Vendor / Product
Mozilla / Firefox
Sources
cve.org  ·  NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
yes
Tech. Impact
total
Affected products (2)
VendorProductPlatformVersions
Mozilla Firefox — 147 ≤ *
Mozilla Thunderbird — 147 ≤ *
Weakness (CWE)
CWESourceDescription
CWE-284 adp CWE-284 Improper Access Control
CWE-693 adp CWE-693 Protection Mechanism Failure
CVSS scores (2)
ScoreSeverityVersionSourceVector
10.0 CRITICAL 3.1 adp CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
7.5 HIGH 3.1 adp CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
References (3)
Back to overview