CVE-2026-4688: 
NixOS vulnerability analysis and mitigation

CVE-2026-4688 is a sandbox escape vulnerability caused by a use-after-free flaw in Mozilla Firefox's Disability Access APIs component. Discovered and reported by security researcher Sajeeb Lohani, it was publicly disclosed on March 24, 2026, alongside the release of patched versions. Affected products include Firefox versions prior to 149 and Firefox ESR versions prior to 140.9, as well as Thunderbird 149 and Thunderbird ESR 140.9. The vulnerability carries a CVSS v3.1 base score of 10.0 (Critical) (Mozilla Advisory (Firefox 149), Mozilla Advisory (ESR 140.9)).

The root cause is a use-after-free condition (CWE-416) in Firefox's Disability Access APIs — the subsystem responsible for exposing browser content to assistive technologies such as screen readers. A use-after-free occurs when a program continues to reference memory after it has been freed, allowing an attacker to control the freed memory region and redirect execution. Because the Disability Access APIs operate with elevated inter-process communication privileges to bridge the sandboxed content process and the host OS, exploiting this flaw can break out of Firefox's content sandbox entirely. No authentication, user interaction, or special network conditions are required for exploitation, and the attack vector is network-accessible (Mozilla Advisory (Firefox 149), Mozilla Advisory (ESR 140.9)).

Successful exploitation allows a remote attacker to escape Firefox's content process sandbox and execute arbitrary code with the privileges of the user running the browser, fully compromising confidentiality, integrity, and availability of the affected system. An attacker could read sensitive files, install malware or persistent backdoors, modify system data, or pivot to other systems on the local network. The scope change (S:C in the CVSS vector) reflects that the impact extends beyond the browser sandbox to the underlying host operating system (Mozilla Advisory (Firefox 149), Mozilla Advisory (ESR 140.9)).

As of the time of disclosure, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation (Feedly). The vulnerability has an EPSS score of approximately 0.02% (0.000200000), indicating a currently low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog at this time. However, the critical CVSS score of 10.0, the lack of any exploitation preconditions, and the high-value nature of browser sandbox escapes make this a high-priority patching target.

Mozilla has released patches addressing this vulnerability. Users should immediately update to Firefox 149 or later for standard releases, or Firefox ESR 140.9 or later for Extended Support Release deployments. Thunderbird users should update to Thunderbird 149 or Thunderbird ESR 140.9. Linux distribution vendors including Red Hat, AlmaLinux, Rocky Linux, Debian, openSUSE, and Amazon Linux have also issued updated packages. No configuration-based workaround is available; upgrading to a patched version is the only effective remediation (Mozilla Advisory (Firefox 149), Mozilla Advisory (ESR 140.9)).

Mozilla rated the vulnerability as "high" impact in its official advisories and released fixes across all supported release channels simultaneously on March 24, 2026. Security news outlets including CyberSecurityNews and HealSecurity covered the Firefox 149 release, highlighting the large number of vulnerabilities (37) addressed in the update. Multiple Linux distribution vendors rapidly issued downstream security advisories and updated packages within days of the Mozilla disclosure, reflecting the severity of the sandbox escape class of vulnerabilities (Mozilla Advisory (Firefox 149)).