Vulnerability · Published Mar 24, 2026 · Assigned by mozilla
CVE-2026-4692Sandbox escape in the Responsive Design Mode component
Critical 9.6
In plain English
A critical-severity security flaw in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)9.6Critical
Exploit odds (30 days)0.5%top 56.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
Sandbox escape in the Responsive Design Mode component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | firefox | 140.9.0-1.el10_1 | ALSA-2026:5931 |
| AlmaLinux:8 | firefox | 140.9.0-1.el8_10.alma.1 | ALSA-2026:5932 |
| AlmaLinux:9 | firefox | 140.9.0-1.el9_7.alma.1 | ALSA-2026:5930 |
| AlmaLinux:9 | firefox-x11 | 140.9.0-1.el9_7.alma.1 | ALSA-2026:5930 |
| AlmaLinux:10 | thunderbird | 140.9.0-1.el10_1.alma.1 | ALSA-2026:6342 |
| AlmaLinux:8 | thunderbird | 140.9.0-1.el8_10.alma.1 | ALSA-2026:6917 |
| AlmaLinux:9 | thunderbird | 140.9.0-1.el9_7.alma.1 | ALSA-2026:6188 |
| Debian:12 | firefox-esr | 140.9.0esr-1~deb12u1 | DSA-6178-1 |
| Debian:12 | firefox-esr | 140.9.0esr-1~deb12u1 | DEBIAN-CVE-2026-4692 |
| Debian:13 | firefox-esr | 140.9.0esr-1~deb13u1 | DEBIAN-CVE-2026-4692 |
| Debian:13 | firefox-esr | 140.9.0esr-1~deb13u1 | DSA-6178-1 |
| Debian:14 | firefox-esr | 140.9.0esr-1 | DEBIAN-CVE-2026-4692 |
| Debian:12 | thunderbird | 1:140.9.0esr-1~deb12u1 | DSA-6179-1 |
| Debian:12 | thunderbird | 1:140.9.0esr-1~deb12u1 | DEBIAN-CVE-2026-4692 |
| Debian:13 | thunderbird | 1:140.9.0esr-1~deb13u1 | DEBIAN-CVE-2026-4692 |
| Debian:13 | thunderbird | 1:140.9.0esr-1~deb13u1 | DSA-6179-1 |
| Debian:14 | thunderbird | 1:140.9.0esr-1 | DEBIAN-CVE-2026-4692 |
| Rocky Linux:10 | firefox | 0:140.9.0-1.el10_1 | RLSA-2026:5931 |
| Rocky Linux:8 | firefox | 0:140.9.0-1.el8_10 | RLSA-2026:5932 |
| Rocky Linux:9 | firefox | 0:140.9.0-1.el9_7 | RLSA-2026:5930 |
| Rocky Linux:10 | thunderbird | 0:140.9.0-1.el10_1 | RLSA-2026:6342 |
| Rocky Linux:8 | thunderbird | 0:140.9.0-1.el8_10 | RLSA-2026:6917 |
| Rocky Linux:9 | thunderbird | 0:140.9.0-1.el9_7 | RLSA-2026:6188 |
| Ubuntu:22.04:LTS | mozjs102 | no fix listed | UBUNTU-CVE-2026-4692 |
| Ubuntu:24.04:LTS | mozjs102 | no fix listed | UBUNTU-CVE-2026-4692 |
| Ubuntu:24.04:LTS | mozjs115 | no fix listed | UBUNTU-CVE-2026-4692 |
| Ubuntu:22.04:LTS | mozjs78 | no fix listed | UBUNTU-CVE-2026-4692 |
| Ubuntu:22.04:LTS | mozjs91 | no fix listed | UBUNTU-CVE-2026-4692 |
| Ubuntu:22.04:LTS | thunderbird | no fix listed | UBUNTU-CVE-2026-4692 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | see references |
| Mozilla | Thunderbird | see references |
Weakness: CWE-653 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2017643
- https://www.mozilla.org/security/advisories/mfsa2026-20/
- https://www.mozilla.org/security/advisories/mfsa2026-21/
- https://www.mozilla.org/security/advisories/mfsa2026-22/
- https://www.mozilla.org/security/advisories/mfsa2026-23/
- https://www.mozilla.org/security/advisories/mfsa2026-24/
- https://access.redhat.com/security/cve/CVE-2026-4692 vdb-entry, x_refsource_REDHAT
- RHBZ#2450748 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4692.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:8427 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7843 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8315 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5931 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6342 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5932 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6917 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7840 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8285 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7858 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8850 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7842 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8289 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7838 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8288 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7839 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8286 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7841 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8287 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7845 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8290 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7837 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8284 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5930 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6188 vendor-advisory, x_refsource_REDHAT