CVE-2026-4688 is a use-after-free vulnerability in the Disability Access APIs component of Mozilla Firefox that enables sandbox escape. This memory safety bug could allow an attacker to execute arbitrary code with elevated privileges by escaping the browser's sandbox environment. The vulnerability has a CVSS 3.1 base score of 9.6 (critical) reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability. Mozilla fixed this vulnerability in Firefox 149 and Firefox ESR 140.9 as part of a broader security update addressing multiple high-impact memory safety bugs.

Successful exploitation of CVE-2026-4688 could allow an attacker to escape the Firefox sandbox, potentially leading to arbitrary code execution with elevated privileges. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability is rated critical with a CVSS score of 9.6. No known exploits in the wild have been reported, but the severity and nature of the bug indicate a significant risk if left unpatched.

Mozilla has released official fixes for this vulnerability in Firefox 149 and Firefox ESR 140.9. Users and administrators should update to these versions or later to remediate the issue. Since this is not a cloud service, patching the client software is required. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching. Patch status is confirmed as fixed by Mozilla advisories MFSA 2026-20 and MFSA 2026-22.