GHSA-gw7x-g9xx-wmm2

GHSA-gw7x-g9xx-wmm2 PUBLISHED CVSS 8.600000381469727 HIGH

Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.

Risk Scores

CVSS 3.1

8.600000381469727

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Affected Products

Vendor	Product	Versions
wolfi	firefox	0
chainguard	firefox-esr	0
chainguard	firefox	0

Timeline

Mar 24, 2026 CVE Published
Jun 30, 2026 CVE Updated
Aug 6, 2026 Distribution Patch
Aug 6, 2026 Distribution Patch
Aug 6, 2026 Distribution Patch
Aug 6, 2026 Distribution Patch
Aug 6, 2026 Distribution Patch
Aug 6, 2026 Distribution Patch
Aug 6, 2026 Distribution Patch
Aug 6, 2026 Distribution Patch
Aug 6, 2026 Distribution Patch
Aug 6, 2026 Distribution Patch

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2016368 url
https://www.mozilla.org/security/advisories/mfsa2026-22 url
https://www.mozilla.org/security/advisories/mfsa2026-23 url
https://www.mozilla.org/security/advisories/mfsa2026-24 url
https://nvd.nist.gov/vuln/detail/CVE-2026-4687 advisory
https://access.redhat.com/errata/RHSA-2026:5930 url
https://access.redhat.com/errata/RHSA-2026:8287 url
https://access.redhat.com/errata/RHSA-2026:8288 url
https://access.redhat.com/errata/RHSA-2026:8289 url
https://access.redhat.com/errata/RHSA-2026:8290 url
https://access.redhat.com/errata/RHSA-2026:8315 url
https://access.redhat.com/errata/RHSA-2026:8427 url
https://access.redhat.com/errata/RHSA-2026:8850 url
https://access.redhat.com/security/cve/CVE-2026-4687 url
https://bugzilla.redhat.com/show_bug.cgi?id=2450757 url
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4687.json url
https://www.mozilla.org/security/advisories/mfsa2026-20 url
https://www.mozilla.org/security/advisories/mfsa2026-21 url
https://access.redhat.com/errata/RHSA-2026:5931 url
https://access.redhat.com/errata/RHSA-2026:5932 url

…and 15 more

Open in Interactive Console →