Sandbox Escape Vulnerability in Mozilla Firefox
CVE-2026-4692

9.6CRITICAL

Key Information:

Vendor

Mozilla
Status
Firefox
Thunderbird
Vendor
CVE Published:
24 March 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-4692?

An issue has been identified in the Responsive Design Mode component of Mozilla Firefox that allows for a sandbox escape. This vulnerability impacts users running versions prior to Firefox 149, as well as Firefox ESR versions below 115.34 and 140.9. The flaw could potentially enable an attacker to bypass security measures designed to isolate the execution environment, thereby allowing unauthorized actions within the browser. Users are strongly advised to update to secure versions to mitigate potential risks.

Affected Version(s)

Firefox 115.34

Firefox 140.9

Firefox 149

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-4692-trust-me-im-in-rdm
Created by SneakyNachos

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2017643
https://www.mozilla.org/security/advisories/mfsa2026-20/
https://www.mozilla.org/security/advisories/mfsa2026-21/

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tom Ritter
.