CVE-2026-4689 is a sandbox escape caused by incorrect boundary conditions and an integer overflow in the XPCOM component of Firefox, scored CVSS 10.0. Mozilla fixed it in Firefox 149, ESR 115.34, ESR 140.9, Thunderbird 149 and Thunderbird 140.9. Update to one of those or later.
What's affected
The NVD record lists these fixed builds: Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149 and Thunderbird 140.9. Mozilla advisories MFSA 2026-20 (Firefox 149), MFSA 2026-21 (ESR 115.34) and MFSA 2026-22 (ESR 140.9) list the entry as high impact. The record also references MFSA 2026-23 and 2026-24, which cover Thunderbird, though I did not fetch those pages.
The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
The older ESR 115 line is notable. Some organizations stay on it for legacy platforms, and this entry is one reason to move.
How to check if you're exposed
- In Firefox, open Help, then About Firefox, or visit about:support.
- In Thunderbird, open Help, then About Thunderbird.
- Compare the version with the fixed builds for your release channel.
- For fleets, run a software inventory query for Firefox and Thunderbird versions and group by channel: release, ESR 115 and ESR 140.
This is also a good moment to look at how you track browser versions generally. The free in-browser dependency scan at gold.safeguard.sh/scan covers application dependencies, so use your endpoint inventory for desktop software.
What to do now
- Update Firefox to 149, ESR 140.9 or ESR 115.34, or later.
- Update Thunderbird to 149 or 140.9, or later.
- Restart each application, since updates apply on restart.
- Check shared images, VDI templates and kiosks that update slowly.
- Plan to leave ESR 115 if you are still on it.
- Confirm versions across devices a few days after rollout.
The advisories list no workaround, so patching is the response.
Why it matters
The classes are CWE-120 (classic buffer copy without size check), CWE-190 (integer overflow) and CWE-754 (improper check for unusual conditions). An integer overflow in size arithmetic can lead to a buffer that is too small for the data written into it.
Modern browsers run web content in a restricted process. A bug in a shared component such as XPCOM is more serious because a flaw there can help content break out of that restriction. Mozilla rates the entry high impact and gives no further technical detail.
The record's KEV flag is false. The Mozilla advisories I fetched do not say this entry was exploited. Other memory safety entries in the same advisories carry the usual Mozilla note about possible code execution, but they are separate CVEs.
Try it yourself
This demo shows how a zero day watch surfaces a new advisory and tells you what to update first.
Click through it at your own pace, or open it full screen.
Quick check
Does a sandbox escape mean a website alone can take over my machine?
Not on its own. Escaping the sandbox is usually one step in a chain. The advisory gives no exploitation details, so the safe response is to update.
Is CVE-2026-4689 on the CISA KEV list?
The record's KEV flag is false at the time of review.
Sources
- Mozilla advisory MFSA 2026-20
- Mozilla advisory MFSA 2026-21
- Mozilla advisory MFSA 2026-22
- Gold page for this CVE
Last reviewed: 19 October 2026.
