CVE-2026-4717

CVE-2026-4717 is a critical privilege escalation vulnerability in the Netmonitor component of Firefox and Thunderbird. Root cause analysis is not disclosed in the advisories but the flaw allows a low-privileged attacker to escalate privileges to a higher level within the browser or mail client environment.

The attack surface is browser-like contexts in Firefox and potentially in Thunderbird when scripting is enabled for mail reading. The vulnerability has a CVSS v3 score of 9.8 indicating it can be exploited remotely without authentication and without user interaction in some scenarios. Advisories note that these flaws cannot typically be exploited through email in Thunderbird because scripting is disabled when reading mail but remain a risk in browser or browser-like browser contexts.

Successful exploitation could allow an attacker to gain elevated privileges within the application potentially leading to arbitrary code execution sandbox escape or access to sensitive data. The impact is high as it enables attackers to bypass security boundaries and compromise the host system.

Mozilla has fixed this vulnerability in Firefox 149 and Firefox ESR 140.9 and Thunderbird 149 and Thunderbird 140.9 released on March 24 2026. Users and administrators should update to the patched versions immediately No workarounds are available

[1] [2] [3] [4]