CVE-2026-4729 encompasses a set of memory safety bugs in Mozilla Firefox 148 and Thunderbird 148. These include use-after-free conditions, incorrect boundary checks, integer overflows, race conditions, and sandbox escapes across various components such as Graphics (WebRender, Canvas2D), Telemetry, Disability Access APIs, XPCOM, CSS Parsing, Responsive Design Mode, Audio/Video playback and codecs, JavaScript Engine (JIT), Layout, Networking, IPC, Widget (Cocoa), and WebRTC. Some of these bugs showed evidence of memory corruption and could potentially be exploited to execute arbitrary code. The vulnerabilities were fixed in Firefox 149 and Thunderbird 149. The vendor advisory confirms the fixes and provides detailed references for each issue.

The vulnerabilities have a critical impact with a CVSS 3.1 score of 9.8, reflecting the potential for remote attackers to execute arbitrary code without privileges or user interaction. The issues affect core browser and email client components, potentially allowing sandbox escapes, privilege escalation, information disclosure, denial-of-service, and arbitrary code execution. However, exploitation in Thunderbird via email is generally mitigated by disabled scripting in mail reading contexts.

Official fixes addressing these vulnerabilities are available in Mozilla Firefox 149 and Thunderbird 149. Users and administrators should update to these versions or later to remediate the issues. Since this is not a cloud service, local patching is required. No additional mitigation actions are indicated by the vendor advisory beyond applying the official updates.