CVE-2026-4704
Published: 24 March 2026
Summary
CVE-2026-4704 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Mozilla Firefox. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 33.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Deeper analysis
CVE-2026-4704 is a denial-of-service vulnerability in the WebRTC Signaling component affecting Mozilla Firefox, Firefox ESR, Thunderbird, and related products. The issue, associated with CWE-400 (Uncontrolled Resource Consumption) and scored 7.5 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), enables resource exhaustion leading to application crashes or significant performance degradation. It was publicly disclosed on March 24, 2026, and addressed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Attackers can exploit this vulnerability remotely over the network with low complexity, requiring no privileges, authentication, or user interaction. Any unauthenticated remote adversary capable of sending malformed WebRTC signaling messages to a vulnerable browser or client can trigger the DoS condition, disrupting availability by consuming excessive resources in the affected component.
Mozilla's security advisories (MFSA 2026-20 through 2026-24) and the associated Bugzilla entry (bug 2014868) detail the patch deployments in the specified versions, recommending immediate upgrades to mitigate the issue. No workarounds are mentioned in the provided references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-14823
Vulnerability details
Denial-of-service in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated exploitation of the WebRTC signaling vulnerability directly triggers uncontrolled resource consumption (CWE-400), enabling application exhaustion and DoS via software vulnerability exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the vulnerability by requiring timely identification, testing, and installation of patches that fix the WebRTC signaling resource exhaustion issue.
Implements denial-of-service protections tailored to prevent resource exhaustion from remote unauthenticated malformed WebRTC signaling messages.
Protects resource availability by monitoring and restricting consumption to counter uncontrolled resource usage leading to crashes in the WebRTC component.