Out-of-bounds write in Mozilla products - CVE-2026-4687

Detailed vulnerability description

The vulnerability allows a remote attacker to escape the sandbox.

The vulnerability exists due to incorrect boundary conditions in the Telemetry component when handling telemetry data. A remote attacker can trick the victim into visiting a specially crafted website and escape the sandbox.

Successful exploitation could allow an attacker to execute code outside the browser's sandbox with elevated privileges.

How to mitigate CVE-2026-4687

Sources

• https://www.mozilla.org/en-US/security/advisories/mfsa2026-21/
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-22/
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-20/
• https://bugzilla.mozilla.org/show_bug.cgi?id=2016368