CVE-2026-4690

HighCVSS 8.6

Published: 24/03/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.77%

52th percentile - higher than 52% of all known CVEs

Summary

A sandbox escape vulnerability due to incorrect boundary conditions and integer overflow in the XPCOM component. Fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Risk Assessment

An attacker can exploit this vulnerability to break out of the sandbox, leading to privilege escalation and potential system compromise.

Recommendation

Immediately update Firefox to version 149 or later, and Thunderbird to version 149 or 140.9. For ESR versions, apply the respective patches (115.34 or 140.9).

Other vulnerabilities in XPCOM

CVE-2026-4689Critical
A sandbox escape vulnerability caused by incorrect boundary conditions and integer overflow in the XPCOM component. The flaw is fixed in Firefox 149, Firefox ESR 115.34 and 140.9, Thunderbird 149, and Thunderbird 140.9.

Original NVD description (English source)

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.