CVE-2026-4689
Published: 24 March 2026
Summary
CVE-2026-4689 is a critical-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Mozilla Firefox. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 47.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2026-4689 is a sandbox escape vulnerability stemming from incorrect boundary conditions and an integer overflow in the XPCOM component of Mozilla products. It affects Firefox versions prior to 149, Firefox ESR versions prior to 115.34 and 140.9, Thunderbird versions prior to 149, and Thunderbird versions prior to 140.9. The issue is classified under CWE-190 (Integer Overflow or Wraparound), CWE-754 (Improper Check for Unusual or Exceptional Conditions), and CWE-120 (Buffer Copy without Checking Size of Input), with a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its potential for complete system compromise.
A remote attacker can exploit this vulnerability over the network with low complexity, requiring no privileges, authentication, or user interaction. Successful exploitation allows scope change from the sandboxed browser process to the host system, granting high-impact confidentiality, integrity, and availability violations, such as arbitrary code execution with the privileges of the affected application.
Mozilla's security advisories (MFSA 2026-20 through 2026-23) and the associated Bugzilla entry (bug 2016374) detail the patch, recommending immediate updates to Firefox 149, Firefox ESR 115.34 or 140.9, Thunderbird 149, or Thunderbird 140.9 to mitigate the issue. No workarounds are specified beyond applying these fixed releases.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-14802
Vulnerability details
Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Sandbox escape via memory corruption (integer overflow/buffer issues) in browser XPCOM directly enables remote client application exploitation (T1203) and privilege escalation across sandbox boundary to host (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates timely patching of flaws like the integer overflow and boundary errors in XPCOM that enable sandbox escape in Firefox and Thunderbird.
Enables scanning to identify systems running vulnerable versions of Firefox and Thunderbird affected by this CVE.
Enforces process isolation to limit the impact of sandbox escapes from browser components to the host system.
Hardening callouts derived
Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).
Oracle Linux 8 (3 rules)
- V-248574 YUM must be configured to prevent the installation of patches, service packs, device drivers, or OL 8 system components that have not been digitally signed using a certificate that is recognized and approved by the organization. via CWE-754
- V-248573 The OL 8 file integrity tool must notify the system administrator (SA) when changes to the baseline configuration or anomalies in the operation of any security functions are discovered within an organizationally defined frequency. via CWE-754
- V-248575 OL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. via CWE-754
Oracle Linux 9 (1 rule)
- V-271452 OL 9 must use a Linux Security Module configured to enforce limits on system services. via CWE-754