CVE-2026-4688 is a use after free in the Disability Access APIs component of Firefox that allows a sandbox escape, scored CVSS 10.0. Mozilla fixed it in Firefox 149, Firefox ESR 140.9, Thunderbird 149 and Thunderbird 140.9. Update to one of those or later.
What's affected
The NVD record lists the fixes as Firefox 149, Firefox ESR 140.9, Thunderbird 149 and Thunderbird 140.9. Mozilla advisories MFSA 2026-20 (Firefox 149) and MFSA 2026-22 (Firefox ESR 140.9) include this entry, rated high impact by Mozilla.
The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The score is the NVD scoring of a sandbox escape. Mozilla's own advisory gives only a short description.
How to check if you're exposed
- In Firefox, open the menu, choose Help, then About Firefox, or visit about:support.
- Compare the version with 149, or 140.9 for ESR.
- For managed fleets, query your software inventory for Firefox and Thunderbird versions below those.
What to do now
- Update Firefox and Thunderbird to the fixed versions or later.
- Restart the browser, since updates apply on restart.
- Check kiosk, VDI and shared images that update slowly.
- Confirm the version across managed devices.
Why it matters
The classes are CWE-416, use after free, and CWE-825, expired pointer dereference. A browser sandbox limits damage from a bug in web content, so a flaw that escapes it matters. The record's KEV flag is false and the Mozilla advisory I read does not say this entry was exploited.
The Disability Access APIs are the browser's accessibility layer, the code that exposes page content to assistive tools such as screen readers. Because that layer handles complex object lifetimes, memory safety bugs can appear there.
Mozilla credits a researcher in the advisory, and the page lists a Bugzilla reference, bug 2016373, for anyone who wants the tracking history once it is public.
Quick check
Do I need to do anything beyond updating?
The advisories list no workaround. Update and restart.
Sources
Last reviewed: 19 October 2026.
