CVE-2026-4725
Critical · 10.0CVSS
10.0
EPSS
0.4%
Published
Mar 24, 2026
CISA due date
—
The record
Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | firefox | 0 | 149.0-r0 |
| Wolfi | firefox | 0 | 149.0-r0 |
| openSUSE:Tumbleweed | MozillaFirefox | 0 | 149.0-1.1 |
Related vulnerabilities
- CVE-2026-4726 Denial-of-service in the XML component. Also affects firefox
- CVE-2026-4724 Undefined behavior in the Audio/Video component. Also affects firefox
- CVE-2026-4729 Memory safety bugs present in Firefox 148 and Thunderbird 148. Also affects firefox
- CVE-2026-4722 Privilege escalation in the IPC component. Also affects firefox
- CVE-2026-4723 Use-after-free in the JavaScript Engine component. Also affects firefox
- CVE-2026-4727 Denial-of-service in the Libraries component in NSS. Also affects firefox
- CVE-2026-4728 Spoofing issue in the Privacy: Anti-Tracking component. Also affects firefox
- CVE-2026-4716 Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component. Also affects firefox