CVE-2026-4689 is a critical security vulnerability in the XPCOM component of Mozilla Firefox and Thunderbird, involving incorrect boundary conditions and an integer overflow that allow sandbox escape. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. The vulnerability has a CVSS 3.1 score of 10.0, reflecting its critical impact and ease of exploitation without privileges or user interaction. The vendor advisory confirms the fix and lists this issue among multiple high-impact vulnerabilities resolved in these versions.

Successful exploitation of this vulnerability could allow an attacker to escape the sandbox environment in Firefox or Thunderbird, potentially leading to full system compromise. The CVSS score of 10.0 indicates critical impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at this time.

This vulnerability is fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. Users and administrators should update to these versions or later to remediate the issue. No additional mitigation steps are required beyond applying the official updates.