CVE-2026-4720 encompasses multiple memory safety bugs affecting Mozilla Firefox and Thunderbird versions prior to Firefox 149 and ESR 140.9. These vulnerabilities include use-after-free, incorrect boundary conditions, integer overflows, and sandbox escapes in components like Graphics (WebRender, Canvas2D), JavaScript Engine (JIT), Audio/Video, Telemetry, CSS Parsing, and others. The bugs could lead to memory corruption and potentially arbitrary code execution. Mozilla released official fixes in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird ESR 140.9 to address these issues. The CVSS v3.1 base score is 9.8, reflecting critical impact with network attack vector, no privileges required, no user interaction, and high confidentiality, integrity, and availability impacts.

Successful exploitation of these memory safety vulnerabilities could allow an attacker to execute arbitrary code remotely without requiring user interaction or privileges, potentially compromising confidentiality, integrity, and availability of the affected systems. The vulnerabilities affect core components of Firefox and Thunderbird, increasing the risk of sandbox escapes and privilege escalations. However, no known exploits in the wild have been reported as of the advisory date.

Mozilla has released official fixes for these vulnerabilities in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird ESR 140.9. Users and administrators should update affected products to these versions or later to mitigate the risk. Since this is not a cloud service, remediation depends on applying these updates. Patch status is confirmed by the vendor advisory. No additional mitigation actions are specified beyond applying the official updates.