CVE-2026-0881

The error is classified as CWE-284 (improper access control) and CWE-693 (protection mechanism bypassed or circumvented) indicating that the Messaging System component does not properly enforce sandbox isolation. A remote attacker, over the network, can send specially crafted data to the component responsible for internal communication in the browser/mail client and thereby execute code outside the sandbox environment, gaining access to operating system resources.

Successful exploitation of this vulnerability allows an attacker to completely compromise the confidentiality, integrity, and availability of the system — including remote code execution (RCE) with the privileges of the browser or mail client process outside the isolated sandbox. The scope of impact extends beyond the vulnerable component itself (CVSS Scope: Changed).

Immediately update Mozilla Firefox to version 147 or later and Mozilla Thunderbird to version 147 or later. Detailed information available in the vendor's security advisories: MFSA2026-01 and MFSA2026-04.

Mozilla Firefox in versions prior to 147 and Mozilla Thunderbird in versions prior to 147.