CVE-2026-4688 is a use-after-free vulnerability in the Disability Access APIs component of Mozilla Firefox that enables sandbox escape. This memory safety bug could allow an attacker to break out of the browser's sandbox environment, potentially leading to arbitrary code execution or other high-impact consequences. The vulnerability was reported by Sajeeb Lohani and fixed in Firefox 149 and Firefox ESR 140.9. It is part of a broader set of memory safety and sandbox escape issues addressed in these releases.

The vulnerability allows sandbox escape, which can compromise the browser's security boundary. This can lead to full compromise of the affected system's confidentiality, integrity, and availability. The CVSS v3.1 score is 9.6 (critical), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and scope change with high impact on confidentiality, integrity, and availability.

Mozilla has released official fixes for this vulnerability in Firefox 149 and Firefox ESR 140.9. Users and administrators should update affected Firefox installations to version 149 or later, or Firefox ESR 140.9 or later, to remediate this issue. No additional mitigations are required beyond applying the official update.