CVE-2026-4725: 
NixOS vulnerability analysis and mitigation

CVE-2026-4725 is a sandbox escape vulnerability caused by a use-after-free condition in the Graphics: Canvas2D component of Mozilla Firefox and Thunderbird. It was discovered by researcher Jun Yang and publicly disclosed on March 24, 2026, as part of Mozilla Foundation Security Advisory 2026-20. The vulnerability affects Firefox versions prior to 149.0 and Thunderbird versions prior to 149.0. Mozilla rates its impact as moderate, while the NVD-assigned CVSS v3.1 base score is 10.0 (Critical) — a discrepancy likely reflecting the theoretical worst-case attack scenario versus practical exploitation constraints (Mozilla Advisory, Red Hat Bugzilla).

The vulnerability is rooted in a use-after-free (CWE-416) condition combined with an expired pointer dereference (CWE-825) within Firefox's Canvas2D graphics processing subsystem. When the browser's Canvas2D component frees a memory object but retains a dangling reference to it, an attacker can manipulate the freed memory region to gain control of execution flow and escape the browser's content process sandbox. The flaw is tracked internally as Mozilla Bug 2017108 and requires no special privileges or user interaction to trigger in a browser context. No public proof-of-concept exploit code has been identified at this time (Mozilla Advisory, Red Hat Bugzilla).

Successful exploitation could allow a remote attacker to escape Firefox's content process sandbox, potentially gaining code execution at the privilege level of the browser process on the underlying host system. This would compromise confidentiality (access to sensitive data outside the sandbox), integrity (ability to modify system state), and availability (potential for crashes or denial of service). In Thunderbird, Mozilla notes that scripting is disabled when reading mail, so exploitation risk is limited to browser-like contexts within the application (Mozilla Advisory, Mozilla Advisory).

As of the time of disclosure, there is no evidence of public proof-of-concept exploit code or active in-the-wild exploitation of CVE-2026-4725. The EPSS score is approximately 0.018% (0.000180), indicating a low current probability of exploitation in the wild. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly).

Mozilla has addressed CVE-2026-4725 in Firefox 149 and Thunderbird 149, released on March 24, 2026. Users and administrators should immediately upgrade all Firefox and Thunderbird installations to version 149.0 or later. No configuration-based workaround has been published; patching is the only recommended remediation. Enterprise administrators should prioritize deployment via their software management tooling given the sandbox escape nature of the flaw (Mozilla Advisory, Mozilla Advisory).

The vulnerability received coverage from security news outlets including The Hacker Wire and CyberSecurityNews, which highlighted the Firefox 149 release and its patch for multiple sandbox escape vulnerabilities. Community discussion on Mastodon and Infosec.exchange noted the severity of the Canvas2D flaw. Tenable published Nessus detection plugins (IDs 303474, 303506, 303888, 304057) shortly after disclosure, and Qualys also added detection support. The broader Firefox 149 advisory — which patched over 37 vulnerabilities including multiple other sandbox escapes — drew significant attention from the security community (The Hacker Wire, Tenable Nessus).