CVE-2026-4688
Critical · CVSS 10.0Firefox / Thunderbird — Sandbox escape via use-after-free in Disability Access APIs (CWE-416, CWE-825)
- CVSS
- 10.0
- nvd
- EPSS
- —
- KEV
- No
- Class
- other
- CWE-416, CWE-416, CWE-825
Description
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Search profile — drives PoC discovery
Symbols Disability Access APIsa11yaccessibilityIAccessibleIAccessibleDocumentDocAccessibleAccEventnsAccessibilityServicemfsa2026-20mfsa2026-22mfsa2026-23mfsa2026-24bug2016373
Keywords CVE-2026-4688Firefox sandbox escapeuse-after-free accessibilityDisability Access APIs UAFFirefox 149 exploitFirefox ESR 140.9 vulnerabilityThunderbird 149 sandbox escapemfsa2026-20 PoCaccessibility API sandbox escape FirefoxCWE-416 Firefox accessibility
Versions: Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, Thunderbird ESR < 140.9
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2016373
- https://www.mozilla.org/security/advisories/mfsa2026-20/
- https://www.mozilla.org/security/advisories/mfsa2026-22/
- https://www.mozilla.org/security/advisories/mfsa2026-23/
- https://www.mozilla.org/security/advisories/mfsa2026-24/
- https://access.redhat.com/errata/RHSA-2026:5930
- https://access.redhat.com/errata/RHSA-2026:5931
- https://access.redhat.com/errata/RHSA-2026:5932
- https://access.redhat.com/errata/RHSA-2026:6188
- https://access.redhat.com/errata/RHSA-2026:6342
- https://access.redhat.com/errata/RHSA-2026:6917
- https://access.redhat.com/errata/RHSA-2026:7837
Status: enriched · ingested 2026-06-30T06:00:22.000Z · profiled 2026-07-01T12:30:14.000Z