CVE-2026-4688: Mozilla Firefox and Thunderbird sandbox escape in Disability Access APIs

CVE-2026-4688 · Severity: critical · CVSS 10 · Published 2026-03-24

A critical security vulnerability has been identified in Mozilla Firefox and Thunderbird that could allow an attacker to bypass the software's security sandbox. This sandbox is a primary defense mechanism designed to prevent malicious websites or emails from accessing the rest of your computer. If exploited, an attacker could gain unauthorized access to your system, potentially leading to data theft or the installation of malware.

Technologies: Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird, Mozilla Thunderbird ESR. Vendors: Mozilla.

Quick answers

Is CVE-2026-4688 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-4688 being exploited in the wild.
How severe is CVE-2026-4688?
Critical severity, with a CVSS score of 10, published 24 March 2026.
Which products and versions are affected?
Mozilla Firefox < 149; Mozilla Firefox ESR < 140.9; Mozilla Thunderbird < 149; Mozilla Thunderbird ESR < 140.9.
Is there a fix for CVE-2026-4688?
A patch was published on 2026-03-24. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4688 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-4688?
Check whether you run Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free vulnerability exists within the Disability Access APIs component of Mozilla browsers and mail clients. The flaw occurs when the application continues to use a pointer after the memory it references has been deallocated, leading to memory corruption. An attacker can leverage this to achieve a sandbox escape, moving from the restricted content process to the more privileged parent process or the host operating system. The vulnerability is reachable via network-delivered content and does not require user interaction according to the NVD CVSS 3.1 assessment. Patches are available in Firefox 149, Firefox ESR 140.9, and corresponding Thunderbird releases.

Affected products

  • Mozilla Firefox < 149
  • Mozilla Firefox ESR < 140.9
  • Mozilla Thunderbird < 149
  • Mozilla Thunderbird ESR < 140.9

Timeline

  • 2026-03-24: disclosed
  • 2026-03-24: advisory
  • 2026-03-24: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.