CVE-2026-4691 is a use-after-free vulnerability classified under CWE-416 affecting the CSS Parsing and Computation component in Mozilla Firefox. This memory safety bug could lead to arbitrary code execution or other severe impacts due to memory corruption. The vulnerability was reported by Fabius Artrel and fixed in Firefox 149 and corresponding ESR and Thunderbird versions. The CVSS v3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting a remotely exploitable flaw without user interaction and with high impact on confidentiality, integrity, and availability. Mozilla's official security advisories (MFSA2026-20 and MFSA2026-21) confirm the fix and provide detailed references to the underlying bug (Bug 2017512).

The vulnerability allows remote attackers to exploit a use-after-free condition in the CSS Parsing and Computation component, potentially leading to arbitrary code execution or complete compromise of the affected Firefox or Thunderbird application. The impact is rated high across confidentiality, integrity, and availability, as indicated by the CVSS score of 9.8. No known active exploits were reported at the time of disclosure.

Mozilla has released official fixes for this vulnerability in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. Users and administrators should update to these versions or later to remediate the issue. Since this is not a cloud service, patching the client software is required. There is no indication from the vendor advisory that any additional mitigation or workaround is necessary beyond applying the official update.