CVE-2026-4725 is a critical use-after-free vulnerability in the Graphics: Canvas2D component of Mozilla Firefox that enables sandbox escape. This vulnerability was addressed and fixed in Firefox version 149. The CVSS 3.1 base score is 9.3, indicating a network attack vector with low attack complexity, no privileges required, user interaction required, and scope changed, with high impact on confidentiality and integrity but no impact on availability. The vendor advisory confirms the fix is included in Firefox 149. No known exploits have been reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to escape the Firefox sandbox, potentially leading to unauthorized access to system resources or sensitive information. The impact is rated high on confidentiality and integrity, with no direct impact on availability. The vulnerability requires user interaction but no privileges and can be exploited remotely over the network.

Mozilla has released an official fix for this vulnerability in Firefox 149. Users and administrators should update to Firefox 149 or later to mitigate this issue. Since the vulnerability is fixed in the official release, no additional mitigation steps are required beyond applying the update.