CVE-2026-4692

10.0 criticalEPSS 0.5%

Critical (10.0) in mozilla. EPSS 0.5% chance of exploitation in the next 30 days.

Sandbox escape in the Responsive Design Mode component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Severity

CVSS 3.1

10.0 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-31)
CWE: CWE-653
Published: 2026-03-24
Modified: 2026-07-15
Record from: the NVD, synced 2026-10-19

Affected

mozilla:firefox
mozilla:thunderbird

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2017643
https://www.mozilla.org/security/advisories/mfsa2026-20/
https://www.mozilla.org/security/advisories/mfsa2026-21/
https://www.mozilla.org/security/advisories/mfsa2026-22/
https://www.mozilla.org/security/advisories/mfsa2026-23/

Check your stack JSON