CVE-2026-4696 is a use-after-free vulnerability identified in the Layout: Text and Fonts component of Mozilla Firefox. This memory safety bug could lead to memory corruption and potentially allow an attacker to execute arbitrary code. The issue affects Firefox versions before 149 and Firefox ESR versions before 115.34 and 140.9. Mozilla has addressed this vulnerability with an official fix in Firefox 149, Firefox ESR 115.34, and Firefox ESR 140.9. The vulnerability has a CVSS v3.1 base score of 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor advisories provide detailed information on the fix and related memory safety issues.

The vulnerability allows remote attackers to exploit a use-after-free condition in the Layout: Text and Fonts component, potentially leading to arbitrary code execution with high impact on confidentiality, integrity, and availability of the affected system. This could enable full compromise of the affected Firefox browser instance. No known exploits in the wild have been reported as of the advisory date.

An official fix is available and has been released by Mozilla in Firefox 149, Firefox ESR 115.34, and Firefox ESR 140.9. Users and administrators should update affected Firefox installations to these versions or later to remediate the vulnerability. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching.