CVE-2026-4725

The vulnerability (CWE-416, use-after-free) consists of referencing a memory area that has already been freed within the component responsible for rendering Canvas2D graphics. Through appropriately crafted web page content, an attacker can trigger a memory management error that leads to the execution of malicious code outside the isolated browser sandbox environment. The network attack vector (AV:N) without privilege requirements (PR:N) and user interaction (UI:N) means that simply visiting a malicious website may be sufficient to trigger the vulnerability.

Successful exploitation of this vulnerability allows an attacker to escape the browser sandbox and potentially gain full control over the victim's system, including data confidentiality, system integrity, and availability (C:H/I:H/A:H in the changed scope S:C).

Mozilla Firefox must be immediately updated to version 149 or later, and Mozilla Thunderbird must be updated to version 149 or later. Detailed information is available in Mozilla security advisories: mfsa2026-20 and mfsa2026-23.

Mozilla Firefox in versions prior to Firefox 149 and Mozilla Thunderbird in versions prior to Thunderbird 149.