Description Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.
CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Exploitability: 3.9 | Impact: 6.0 Attack Vector: Network
Complexity: Low
Privileges: None
User Interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High
Affected Packages6 packages Show 1 more packages
🔴 Vulnerability Details3 OSV CVE-2026-4688: Sandbox escape due to use-after-free in the Disability Access APIs component ↗ 2026-03-24 ▶ GHSA GHSA-7364-g429-cg4v: Sandbox escape due to use-after-free in the Disability Access APIs component ↗ 2026-03-24 ▶ CVEList Sandbox escape due to use-after-free in the Disability Access APIs component ↗ 2026-03-24 ▶
📋 Vendor Advisories6 Red Hat firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component ↗ 2026-03-24 ▶ Debian CVE-2026-4688: firefox - Sandbox escape due to use-after-free in the Disability Access APIs component. Th... ↗ 2026 ▶ Mozilla Mozilla Foundation Security Advisory 2026-23: CVE-2026-4688 ↗ ▶ Mozilla Mozilla Foundation Security Advisory 2026-22: CVE-2026-4688 ↗ ▶ Mozilla Mozilla Foundation Security Advisory 2026-24: CVE-2026-4688 ↗ ▶ Show 1 more
🕵️ Threat Intelligence1 Wiz CVE-2026-4688 Impact, Exploitability, and Mitigation Steps | Wiz ↗ ▶
💬 Community1 Bugzilla CVE-2026-4688 firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component ↗ 2026-03-24 ▶