CVE-2026-4689
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
A sandbox escape vulnerability caused by incorrect boundary conditions and integer overflow in the XPCOM component. The flaw is fixed in Firefox 149, Firefox ESR 115.34 and 140.9, Thunderbird 149, and Thunderbird 140.9.
Risk Assessment
An attacker can exploit this vulnerability to break out of the sandbox and gain unauthorized access to the underlying operating system, potentially leading to full compromise of the application and user data.
Recommendation
Immediately update Firefox to version 149 or later, ESR versions to 115.34/140.9, and Thunderbird to version 149 or 140.9.
Original NVD description (English source)
Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.