Vulnerability · Published Mar 24, 2026 · Assigned by mozilla
CVE-2026-4687Sandbox escape due to incorrect boundary conditions in the Telemetry component
Critical 9.6
In plain English
A critical-severity buffer overflow in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)9.6Critical
Exploit odds (30 days)0.6%top 53.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | firefox | 140.9.0-1.el10_1 | ALSA-2026:5931 |
| AlmaLinux:8 | firefox | 140.9.0-1.el8_10.alma.1 | ALSA-2026:5932 |
| AlmaLinux:9 | firefox | 140.9.0-1.el9_7.alma.1 | ALSA-2026:5930 |
| AlmaLinux:9 | firefox-x11 | 140.9.0-1.el9_7.alma.1 | ALSA-2026:5930 |
| AlmaLinux:10 | thunderbird | 140.9.0-1.el10_1.alma.1 | ALSA-2026:6342 |
| AlmaLinux:8 | thunderbird | 140.9.0-1.el8_10.alma.1 | ALSA-2026:6917 |
| AlmaLinux:9 | thunderbird | 140.9.0-1.el9_7.alma.1 | ALSA-2026:6188 |
| Debian:12 | firefox-esr | 140.9.0esr-1~deb12u1 | DSA-6178-1 |
| Debian:12 | firefox-esr | 140.9.0esr-1~deb12u1 | DEBIAN-CVE-2026-4687 |
| Debian:13 | firefox-esr | 140.9.0esr-1~deb13u1 | DEBIAN-CVE-2026-4687 |
| Debian:13 | firefox-esr | 140.9.0esr-1~deb13u1 | DSA-6178-1 |
| Debian:14 | firefox-esr | 140.9.0esr-1 | DEBIAN-CVE-2026-4687 |
| Debian:12 | thunderbird | 1:140.9.0esr-1~deb12u1 | DSA-6179-1 |
| Debian:12 | thunderbird | 1:140.9.0esr-1~deb12u1 | DEBIAN-CVE-2026-4687 |
| Debian:13 | thunderbird | 1:140.9.0esr-1~deb13u1 | DEBIAN-CVE-2026-4687 |
| Debian:13 | thunderbird | 1:140.9.0esr-1~deb13u1 | DSA-6179-1 |
| Debian:14 | thunderbird | 1:140.9.0esr-1 | DEBIAN-CVE-2026-4687 |
| Rocky Linux:10 | firefox | 0:140.9.0-1.el10_1 | RLSA-2026:5931 |
| Rocky Linux:8 | firefox | 0:140.9.0-1.el8_10 | RLSA-2026:5932 |
| Rocky Linux:9 | firefox | 0:140.9.0-1.el9_7 | RLSA-2026:5930 |
| Rocky Linux:10 | thunderbird | 0:140.9.0-1.el10_1 | RLSA-2026:6342 |
| Rocky Linux:8 | thunderbird | 0:140.9.0-1.el8_10 | RLSA-2026:6917 |
| Rocky Linux:9 | thunderbird | 0:140.9.0-1.el9_7 | RLSA-2026:6188 |
| Ubuntu:22.04:LTS | mozjs102 | no fix listed | UBUNTU-CVE-2026-4687 |
| Ubuntu:24.04:LTS | mozjs102 | no fix listed | UBUNTU-CVE-2026-4687 |
| Ubuntu:24.04:LTS | mozjs115 | no fix listed | UBUNTU-CVE-2026-4687 |
| Ubuntu:22.04:LTS | mozjs78 | no fix listed | UBUNTU-CVE-2026-4687 |
| Ubuntu:22.04:LTS | mozjs91 | no fix listed | UBUNTU-CVE-2026-4687 |
| Ubuntu:22.04:LTS | thunderbird | no fix listed | UBUNTU-CVE-2026-4687 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | see references |
| Mozilla | Thunderbird | see references |
Weakness: CWE-120, CWE-501 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2016368
- https://www.mozilla.org/security/advisories/mfsa2026-20/
- https://www.mozilla.org/security/advisories/mfsa2026-21/
- https://www.mozilla.org/security/advisories/mfsa2026-22/
- https://www.mozilla.org/security/advisories/mfsa2026-23/
- https://www.mozilla.org/security/advisories/mfsa2026-24/
- https://access.redhat.com/security/cve/CVE-2026-4687 vdb-entry, x_refsource_REDHAT
- RHBZ#2450757 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4687.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:8427 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7843 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8315 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5931 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6342 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5932 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6917 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7840 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8285 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7858 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8850 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7842 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8289 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7838 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8288 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7839 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8286 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7841 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8287 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7845 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8290 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7837 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8284 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5930 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6188 vendor-advisory, x_refsource_REDHAT