Security Vulnerability Report
中文
CVE-2026-4688 CVSS 10.0 CRITICAL

CVE-2026-4688

Published: 2026-03-24 13:16:05
Last Modified: 2026-04-13 15:17:37

Description

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

CVSS Details

CVSS Score
10.0
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* - VULNERABLE
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:* - VULNERABLE
Firefox < 149
Firefox ESR < 140.9
Thunderbird < 149
Thunderbird < 140.9

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!-- PoC Concept for CVE-2026-4688 --> <!-- Disclaimer: This is a conceptual example based on the vulnerability description. --> <html> <body> <script> // Simulate interaction with Accessibility APIs let targetElement = document.createElement('div'); document.body.appendChild(targetElement); // Simulate Use-After-Free scenario let vulnerableRef = targetElement.accessibilityNode; // Hypothetical API // Trigger free document.body.removeChild(targetElement); // Attempt to use freed memory (Crash or Exploit) setTimeout(() => { console.log(vulnerableRef.getProperty(0)); }, 100); </script> </body> </html>

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2026-4688", "sourceIdentifier": "[email protected]", "published": "2026-03-24T13:16:04.640", "lastModified": "2026-04-13T15:17:37.207", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}, {"lang": "es", "value": "Escape de sandbox debido a uso después de liberación en el componente de APIs de Accesibilidad. Esta vulnerabilidad afecta a Firefox &lt; 149, Firefox ESR &lt; 140.9, Thunderbird &lt; 149, y Thunderbird &lt; 140.9."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10.0, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 6.0}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "baseScore": 9.6, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 6.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-416"}]}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-416"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*", "versionEndExcluding": "140.9.0", "matchCriteriaId": "DA62D95E-CB01-4586-83DB-5094116FC939"}, {"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*", "versionEndExcluding": "149.0", "matchCriteriaId": "02F2B82F-E997-4D5F-BBB0-237E4962555B"}]}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2016373", "source": "[email protected]", "tags": ["Permissions Required"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-20/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-22/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-23/", "source": "[email protected]"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-24/", "source": "[email protected]"}]}}