CVE-2026-4690: 
NixOS vulnerability analysis and mitigation

CVE-2026-4690 is a sandbox escape vulnerability caused by incorrect boundary conditions and an integer overflow in Firefox's XPCOM component. Discovered and reported by security researcher Sajeeb Lohani, it was publicly disclosed on March 24, 2026, as part of Mozilla's coordinated release of Firefox 149. Affected versions include Firefox before 149, Firefox ESR before 115.34, and Firefox ESR before 140.9; Thunderbird 149 and Thunderbird ESR 140.9 also include the fix. The vulnerability carries a CVSS v3.1 base score of 8.6 (High) (Mozilla Advisory mfsa2026-20, Mozilla Advisory mfsa2026-22).

The root cause is an integer overflow (CWE-190) combined with improper boundary condition checks (CWE-754) in Firefox's XPCOM (Cross-Platform Component Object Model) subsystem, which can lead to a classic buffer overflow (CWE-120). An attacker can trigger the overflow remotely over the network without requiring any user interaction or prior authentication, causing the browser's content process sandbox to be escaped. The vulnerability is tracked internally as Mozilla bug 2016375, though the bug report is access-restricted (Mozilla Advisory mfsa2026-20, Mozilla Advisory mfsa2026-22).

Successful exploitation allows an attacker to escape Firefox's content process sandbox, breaking out of the restricted execution environment and potentially gaining elevated privileges on the underlying host system. The primary assessed impact is high availability disruption due to the sandbox escape capability, with the changed scope metric reflecting that the vulnerability crosses the sandbox security boundary. While the CVSS score does not assess confidentiality or integrity impact directly, a sandbox escape in practice can serve as a stepping stone for further exploitation, including code execution on the host, lateral movement, or data exfiltration (Mozilla Advisory mfsa2026-22, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The vulnerability has an EPSS score of approximately 0.018% (0.000180), indicating a currently low probability of exploitation in the near term. It has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The network-based attack vector with no user interaction required makes this a higher-priority patch target despite the low current exploitation evidence.

Mozilla has released patches addressing this vulnerability in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird ESR 140.9. Organizations should immediately update all affected Firefox and Thunderbird installations to these versions or later. For environments where immediate patching is not feasible, consider restricting Firefox use or applying network-level controls to limit exposure, and monitor systems for anomalous browser process behavior. Downstream Linux distributions including Red Hat, AlmaLinux, Rocky Linux, Debian, openSUSE, and Amazon Linux have also released updated packages (Mozilla Advisory mfsa2026-20, Mozilla Advisory mfsa2026-21, Mozilla Advisory mfsa2026-22).

The vulnerability was part of a large Firefox 149 release that addressed 37 vulnerabilities, which received coverage from security news outlets such as CyberSecurityNews and HealSecurity, noting the breadth of the patch batch. Multiple Linux distribution security teams (Red Hat, Debian, openSUSE, AlmaLinux, Rocky Linux, Amazon Linux) issued advisories and updated packages promptly following Mozilla's disclosure. No notable individual researcher commentary or significant social media discussion specific to CVE-2026-4690 has been identified beyond the general Firefox 149 release coverage (Mozilla Advisory mfsa2026-20).