CVE-2026-4687 is a critical sandbox escape vulnerability in the Telemetry component of Mozilla Firefox caused by incorrect boundary conditions. The flaw allows an attacker to break out of the sandbox environment, potentially leading to full system compromise. This vulnerability affects Firefox and Thunderbird prior to versions Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. Mozilla has released official fixes for these versions. The CVSS v3.1 base score is 9.6, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to escape the sandbox in Firefox or Thunderbird, potentially leading to arbitrary code execution with elevated privileges. The impact is rated critical with high confidentiality, integrity, and availability consequences. However, no known exploits in the wild have been reported as of the advisory date.

Mozilla has released official patches fixing this vulnerability in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. Users and administrators should update to these versions or later to remediate the issue. Since this is not a cloud service, remediation depends on applying these updates. Patch status is confirmed by Mozilla advisories mfsa2026-20 and mfsa2026-21.