CVE-2026-4691 is a use-after-free vulnerability identified in the CSS Parsing and Computation component of Mozilla Firefox. Use-after-free bugs occur when a program continues to use a pointer after the memory it points to has been freed, potentially leading to memory corruption. This vulnerability was reported by Fabius Artrel and fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. The vulnerability is rated critical with a CVSS 3.1 base score of 9.8, reflecting its potential for remote exploitation without user interaction or privileges, and the ability to compromise confidentiality, integrity, and availability. Mozilla's official advisories (MFSA2026-20 and MFSA2026-21) confirm the fix and provide references to the underlying bug (Bug 2017512).

Successful exploitation of this use-after-free vulnerability could allow an attacker to execute arbitrary code remotely with no user interaction or privileges required. The impact includes full compromise of confidentiality, integrity, and availability of the affected system running vulnerable Firefox versions. Given the CVSS score of 9.8, this represents a critical security risk. There are no known exploits in the wild at the time of publication.

Mozilla has released official fixes for this vulnerability in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. Users and administrators should update to these versions or later to remediate the vulnerability. No additional mitigations are specified by the vendor advisory. Patch status is confirmed as fixed in these versions.