CVE-2026-4688
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
A sandbox escape vulnerability due to a use-after-free bug in the Disability Access APIs component. The flaw was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Risk Assessment
An attacker could exploit this vulnerability to break out of the browser sandbox and gain access to the underlying operating system, potentially leading to full device compromise or data theft.
Recommendation
Immediately update Firefox to version 149 or Firefox ESR to 140.9, and Thunderbird to version 149 or 140.9 to mitigate the sandbox escape risk.
Original NVD description (English source)
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.