CVE-2026-4690
Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component
CVSS Score
9.6
EPSS Score
0.0%
EPSS Percentile
0th
Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
| Vendor | mozilla |
| Product | firefox |
| Ecosystems | |
| Industries | Technology |
| Published | Mar 24, 2026 |
| Last Updated | Jul 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for mozilla firefox
Be the first to know when new critical vulnerabilities affecting mozilla firefox are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Mozilla / Firefox
All versions affected Mozilla / Thunderbird
All versions affected References
bugzilla.mozilla.org: https://bugzilla.mozilla.org/show_bug.cgi?id=2016375 mozilla.org: https://www.mozilla.org/security/advisories/mfsa2026-20/ mozilla.org: https://www.mozilla.org/security/advisories/mfsa2026-21/ mozilla.org: https://www.mozilla.org/security/advisories/mfsa2026-22/ mozilla.org: https://www.mozilla.org/security/advisories/mfsa2026-23/ mozilla.org: https://www.mozilla.org/security/advisories/mfsa2026-24/ access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-4690 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2450732 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4690.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8427 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7843 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8315 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:5931 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:6342 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:5932 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:6917 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7840 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8285 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7858 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8850 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7842 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8289 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7838 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8288 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7839 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8286 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7841 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8287 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7845 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8290 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7837 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8284 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:5930 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:6188
Credits
Sajeeb Lohani