CVE-2026-4696 is a use-after-free vulnerability classified under CWE-416 affecting the Layout: Text and Fonts component in Mozilla Firefox. It was reported by Sota Wada and is rated with a CVSS 3.1 base score of 9.8 (critical), indicating network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability was fixed in Firefox 149 and corresponding ESR and Thunderbird versions. Mozilla's security advisories (MFSA2026-20 and MFSA2026-21) provide detailed information and confirm the availability of patches.

Successful exploitation of this use-after-free vulnerability could lead to arbitrary code execution within the context of the affected application, compromising confidentiality, integrity, and availability. The CVSS score of 9.8 reflects the critical nature of this flaw. However, there are currently no known exploits in the wild targeting this vulnerability.

Mozilla has released official patches fixing this vulnerability in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. Users and administrators should update to these fixed versions or later to remediate the vulnerability. Since the vendor advisory confirms the availability of official fixes, applying these updates is the recommended mitigation. No additional vendor-recommended mitigations or workarounds are indicated.