CVE-2026-4687 is a sandbox escape vulnerability in Mozilla Firefox's Telemetry component due to incorrect boundary conditions. This flaw could allow an attacker to break out of the sandbox environment, potentially leading to arbitrary code execution with elevated privileges. The vulnerability affects Firefox versions prior to 149 and Firefox ESR versions prior to 115.34 and 140.9, as well as corresponding Thunderbird versions. Mozilla has released official fixes in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. The vulnerability has a CVSS 3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to escape the sandbox environment in Firefox, potentially leading to arbitrary code execution with elevated privileges. This compromises the security boundaries intended to isolate web content and protect the host system. The impact includes full compromise of confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported at this time.

Mozilla has released official patches that fix this vulnerability in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. Users and administrators should update affected products to these versions or later to remediate the issue. Since this is not a cloud service, remediation depends on applying these updates. Patch status is confirmed by the Mozilla security advisories linked in the vendor advisory content.