Firefox <149 Sandbox Escape: XPCOM Integer Overflow
CVE-2026-4689 Published on March 24, 2026
Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component
Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.
Products Associated with CVE-2026-4689
Want to know whenever a new CVE is published for Mozilla products? stack.watch will email you.
Affected Versions
Mozilla Firefox:- Version unspecified and below 149 is affected.
- Version unspecified and below 115.34 is affected.
- Version unspecified and below 140.9 is affected.
- Version unspecified and below 149 is affected.
- Version unspecified and below 140.9 is affected.