CVE-2026-4725 is a sandbox escape caused by a use after free in the Graphics: Canvas2D component in Firefox. The NVD record scores it CVSS 10.0 (critical), while Mozilla rates it Moderate. Mozilla fixed it in Firefox 149 and Thunderbird 149. Update to those versions or later, and check bundled copies too.
What's affected
The NVD record lists Mozilla Firefox as affected, and the description says the vulnerability was fixed in the following releases:
- Firefox 149
- Thunderbird 149
Only the rapid release line is named. The ESR releases are not listed for this CVE, so ESR users should read the Mozilla advisory for their branch rather than assume a result.
How to check if you're exposed
- Find your version. In Firefox open the menu, choose Help, then About Firefox. For Thunderbird use Help, then About Thunderbird.
- From a terminal, run
firefox --versionorthunderbird --version. On macOS the binary sits inside the app bundle, for example/Applications/Firefox.app/Contents/MacOS/firefox --version. - On Debian or Ubuntu,
apt list --installed 2>/dev/null | grep -i -E 'firefox|thunderbird'shows what the package manager installed. On Fedora or RHEL, userpm -q firefox thunderbird. - Compare the result with the fixed versions above. Anything older on the same branch is exposed to CVE-2026-4725.
Bundled copies are easy to miss. Kiosk images, test runners with a pinned Firefox, and container images can carry old builds, and a scan of the image catches those.
What to do now
- Update Firefox and Thunderbird on every managed device to the fixed version for the branch you run.
- Restart the browser after the update. Mozilla's updater only protects you once the new build is running.
- Update images and CI runners that pin a Firefox version, such as browser test containers.
- Where you cannot update today, limit who can browse untrusted sites from the affected machine and plan the update for the next change window.
- Record the new version in your inventory so the next review takes minutes.
Why it matters
The record maps this to CWE-416, which covers use after free, where code keeps using memory after it has been released. The affected component is Graphics: Canvas2D. Mozilla's advisory lists the entry as moderate impact and gives no further technical detail, which is normal while most users are still updating.
A sandbox escape matters because Firefox runs web content in restricted processes on purpose. The NVD vector shows Scope Changed and a 10.0 score. Mozilla's own rating for the entry is Moderate, which is a useful reminder that vendor ratings and NVD scores answer slightly different questions. The record's KEV flag is false and the advisory does not report exploitation.
Quick check
Is CVE-2026-4725 exploited in the wild?
The record's KEV flag is false, and the Mozilla advisory I read does not say it is exploited. That can change, so keep watching the advisory and update promptly.
Sources
Last reviewed: 19 October 2026.
