CVE-2026-4689

The vulnerability results from improper verification of boundary conditions (CWE-754) and integer overflow (CWE-190) in the XPCOM component, which is responsible for communication between internal browser modules. Incorrect buffer boundary calculations lead to buffer overflow (CWE-120), which allows an attacker to execute code outside the isolated sandbox environment. The attack can be performed remotely, without authentication and without user interaction, and its effects extend beyond the application context itself (scope: changed, Scope: Changed).

An attacker can escape the sandbox mechanism of the browser or email client and gain the ability to execute arbitrary code in the context of the operating system, resulting in complete breach of confidentiality, integrity, and availability of the attacked system.

Software must be updated immediately to Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, or Thunderbird 140.9, in which the vulnerability has been fixed. Details are available in Mozilla security advisories: mfsa2026-20, mfsa2026-21, mfsa2026-22, mfsa2026-23.

Mozilla Firefox in versions before 149 and before Firefox ESR 115.34 and Firefox ESR 140.9; Mozilla Thunderbird in versions before 149 and before Thunderbird 140.9.