CVE-2026-4691

The use-after-free vulnerability occurs when the application references a memory area after it has been freed during parsing or processing of CSS rules. An attacker can craft appropriately malicious CSS content (e.g., on a website or in an HTML email message) that triggers an incorrect reference to the freed memory. This allows controlled writing or execution of data in that area, which can lead to taking control of the application process.

An attacker can gain full control over the browser or email client process, which includes disclosure of sensitive data, data modification, and potential arbitrary code execution (RCE) in the context of a logged-in user.

Software must be updated immediately to the following versions: Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149 or Thunderbird 140.9. Patches are available from the vendor according to references (mfsa2026-20, mfsa2026-21, mfsa2026-22, mfsa2026-23).

Mozilla Firefox before version 149, Mozilla Firefox ESR before versions 115.34 and 140.9, Mozilla Thunderbird before version 149, and Mozilla Thunderbird ESR before version 140.9.