CVE-2026-4689

47th percentile - higher than 47% of all known CVEs

Sandbox escape due to incorrect boundary conditions and integer overflow in the XPCOM component. The vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

An attacker can exploit this vulnerability to break out of the sandbox, potentially leading to arbitrary code execution outside browser restrictions and privilege escalation on the system.

Immediately update Firefox to version 149 or later, ESR versions to 115.34/140.9, and Thunderbird to 149/140.9. Prioritize systems where untrusted content is processed.