Vulnerability details
CVE-2026-4687
Red Hat Enterprise Linux 10
Sandbox escape due to incorrect boundary conditions in the Telemetry component
CVSS 3.1
7.5High
Official description
Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.6Critical | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux 10 | All | CVEProject cvelistV5 (CNA) |
References and advisories
34- https://bugzilla.mozilla.org/show_bug.cgi?id=2016368
- https://www.mozilla.org/security/advisories/mfsa2026-20/
- https://www.mozilla.org/security/advisories/mfsa2026-21/
- https://www.mozilla.org/security/advisories/mfsa2026-22/
- https://www.mozilla.org/security/advisories/mfsa2026-23/
- https://www.mozilla.org/security/advisories/mfsa2026-24/
- https://access.redhat.com/security/cve/CVE-2026-4687 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2450757 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4687.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:8427 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7843 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8315 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5931 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6342 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5932 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6917 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7840 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8285 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7858 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8850 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7842 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8289 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7838 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8288 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7839 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8286 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7841 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8287 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7845 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8290 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7837 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8284 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5930 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6188 vendor-advisoryx_refsource_REDHAT
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-03-24
- Last updated
- 2026-07-15
- State
- Published
- Assigner (CNA)
- mozilla
Exploit prediction (EPSS)
0.56%
Probability of exploitation in 30 days
46.7%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
- CWE-501Trust Boundary Violation