CVE-2026-4726
Published: 24 March 2026
Summary
CVE-2026-4726 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Mozilla Firefox. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application Exhaustion Flood (T1499.003); ranked at the 3.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation directly mitigates CVE-2026-4726 by requiring timely application of patches such as Firefox/Thunderbird version 149 to eliminate the XML parser resource exhaustion vulnerability.
Denial-of-service protection implements mechanisms to counter resource exhaustion attacks like this uncontrolled consumption in the XML component.
Resource availability protection safeguards against unauthorized resource depletion, directly addressing the CWE-400 uncontrolled consumption triggered by malicious XML inputs.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE directly describes remote exploitation of XML parser for resource exhaustion (CWE-400), matching T1499.003 Application Exhaustion Flood subtechnique under Endpoint Denial of Service.
NVD Description
Denial-of-service in the XML component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.
Deeper analysisAI
CVE-2026-4726 is a denial-of-service vulnerability in the XML component of Mozilla Firefox and Thunderbird, stemming from uncontrolled resource consumption as classified under CWE-400. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high availability impact with no confidentiality or integrity effects. The vulnerability was fixed in Firefox version 149 and Thunderbird version 149.
A remote, unauthenticated attacker can exploit this over the network with low complexity and no user interaction required. Exploitation triggers resource exhaustion in the XML parser, leading to denial of service such as application crashes or severe performance degradation in affected browsers or email clients.
Mozilla's security advisories MFSA 2026-20 and MFSA 2026-23 document the patch details and release notes, with additional technical analysis available in Bugzilla bug 1955311. Mitigation involves updating to Firefox 149 or Thunderbird 149, as no workarounds are specified in the provided references.
Details
- CWE(s)