CVE-2026-4689
Published: 24 March 2026
Description
Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Mitigating Controls (NIST 800-53 r5)AI
Mandates timely patching of flaws like the integer overflow and boundary errors in XPCOM that enable sandbox escape in Firefox and Thunderbird.
Enables scanning to identify systems running vulnerable versions of Firefox and Thunderbird affected by this CVE.
Enforces process isolation to limit the impact of sandbox escapes from browser components to the host system.
Security SummaryAI
CVE-2026-4689 is a sandbox escape vulnerability stemming from incorrect boundary conditions and an integer overflow in the XPCOM component of Mozilla products. It affects Firefox versions prior to 149, Firefox ESR versions prior to 115.34 and 140.9, Thunderbird versions prior to 149, and Thunderbird versions prior to 140.9. The issue is classified under CWE-190 (Integer Overflow or Wraparound), CWE-754 (Improper Check for Unusual or Exceptional Conditions), and CWE-120 (Buffer Copy without Checking Size of Input), with a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its potential for complete system compromise.
A remote attacker can exploit this vulnerability over the network with low complexity, requiring no privileges, authentication, or user interaction. Successful exploitation allows scope change from the sandboxed browser process to the host system, granting high-impact confidentiality, integrity, and availability violations, such as arbitrary code execution with the privileges of the affected application.
Mozilla's security advisories (MFSA 2026-20 through 2026-23) and the associated Bugzilla entry (bug 2016374) detail the patch, recommending immediate updates to Firefox 149, Firefox ESR 115.34 or 140.9, Thunderbird 149, or Thunderbird 140.9 to mitigate the issue. No workarounds are specified beyond applying these fixed releases.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Sandbox escape via memory corruption (integer overflow/buffer issues) in browser XPCOM directly enables remote client application exploitation (T1203) and privilege escalation across sandbox boundary to host (T1068).