CVE-2026-4692: 
NixOS vulnerability analysis and mitigation

CVE-2026-4692 is a sandbox escape vulnerability in the Responsive Design Mode component of Mozilla Firefox and Thunderbird. Discovered by researcher Tom Ritter and disclosed on March 24, 2026, it affects Firefox prior to version 149, Firefox ESR prior to 115.34, Firefox ESR prior to 140.9, Thunderbird prior to 149, and Thunderbird ESR prior to 140.9. The vulnerability carries a CVSS v3.1 base score of 10.0 (Critical), reflecting its network-based, no-user-interaction attack vector with changed scope (Mozilla Advisory mfsa2026-20, Mozilla Advisory mfsa2026-22).

The vulnerability is classified under CWE-653 (Improper Isolation or Compartmentalization), indicating that the Responsive Design Mode component fails to properly enforce sandbox boundaries between privileged and unprivileged browser contexts. An attacker can exploit this flaw over the network without requiring any user interaction or special privileges, allowing code executing within the browser's content sandbox to escape into the broader browser process. The underlying bug is tracked as Mozilla Bug 2017643, though the full technical details remain restricted (Mozilla Advisory mfsa2026-20, Mozilla Advisory mfsa2026-21).

Successful exploitation allows an attacker to escape the Firefox or Thunderbird content sandbox, potentially achieving arbitrary code execution with the privileges of the browser process on the underlying system. The impact spans all three security dimensions — confidentiality, integrity, and availability — at a high level, and the changed scope means the attacker can affect resources beyond the sandboxed browser context. This could enable data exfiltration, installation of malware, or further lateral movement within the victim's environment (Mozilla Advisory mfsa2026-22, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is approximately 0.009% (0.000090), indicating a currently low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the critical CVSS score of 10.0 and the no-user-interaction, network-accessible attack vector make this a high-priority patching target.

Mozilla has released patches addressing CVE-2026-4692 in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird ESR 140.9. Organizations should immediately update all affected Firefox and Thunderbird installations to the patched versions. No configuration-based workaround is available; upgrading is the only remediation. Given the critical CVSS score of 10.0 and the network-accessible, no-user-interaction attack vector, patching should be treated as urgent (Mozilla Advisory mfsa2026-20, Mozilla Advisory mfsa2026-21, Mozilla Advisory mfsa2026-22).

The vulnerability was part of a large March 24, 2026 Mozilla security release that addressed over 37 vulnerabilities in Firefox 149, drawing coverage from security news outlets including CyberSecurityNews and HealSecurity, which highlighted the critical nature of the sandbox escapes in the release. Multiple Linux distributions — including Debian, openSUSE, AlmaLinux, Rocky Linux, Oracle Linux, and Amazon Linux — issued downstream advisories and updated packages shortly after Mozilla's disclosure. Red Hat issued multiple errata (e.g., RHSA-2026:5930, RHSA-2026:5931) addressing the vulnerability across its product lines (Mozilla Advisory mfsa2026-20).