DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-4692: CVE-2026-4692: Sandbox Escape via Responsive Design Mode in Mozilla Firefox and Thunderbird

#security #cve #cybersecurity

CVE-2026-4692: Sandbox Escape via Responsive Design Mode in Mozilla Firefox and Thunderbird

Vulnerability ID: CVE-2026-4692
CVSS Score: 10.0
Published: 2026-03-24

CVE-2026-4692 is a critical security vulnerability within the multi-process architecture of Mozilla Firefox, Firefox ESR, and Mozilla Thunderbird. It is classified as a sandbox escape residing in the Responsive Design Mode (RDM) component. Due to a missing authorization check during Inter-Process Communication (IPC) synchronization of BrowsingContext state, a compromised content process can unilaterally declare its top-level browsing context to be rendered in Responsive Design Mode. This state modification relaxes hit-test bounds restrictions, enabling the content process to dispatch synthesized touch events that target and trigger clicks within privileged browser UI (Chrome UI) elements. The exploitation of this vulnerability achieves complete sandbox escape and arbitrary code execution in the context of the parent process.

TL;DR

A missing authorization check in Firefox's IPC synchronization allows a compromised content process to force the InRDMPane flag to true, enabling synthesized touch events to bypass coordinate checks and click privileged Chrome UI elements to escape the sandbox.

Technical Details

  • CWE ID: CWE-653: Insufficient Compartmentalization
  • Attack Vector: Network
  • CVSS Base Score: 10.0
  • Exploit Maturity: Proof-of-Concept
  • CISA KEV Status: Not Listed
  • Primary Component: Responsive Design Mode (RDM)

Affected Systems

  • Mozilla Firefox
  • Mozilla Firefox ESR
  • Mozilla Thunderbird
  • Firefox: < 149.0 (Fixed in: 149.0)
  • Firefox ESR: < 115.34.0 (Fixed in: 115.34.0)
  • Firefox ESR: [128.0, 140.9.0) (Fixed in: 140.9.0)
  • Thunderbird: < 149.0 (Fixed in: 149.0)
  • Thunderbird: < 140.9.0 (Fixed in: 140.9.0)

Code Analysis

Commit: a9279ce

Add origin checks for Responsive Design Mode state synchronizations

Exploit Details

  • GitHub: Proof of Concept showing state manipulation of InRDMPane over the IPC channel

Mitigation Strategies

  • Upgrade to patched browser versions immediately
  • Enforce Fission Site Isolation across all systems
  • Implement enterprise policies to restrict about:config and developer tools access

Remediation Steps:

  1. Locate and identify all installations of Mozilla Firefox, Firefox ESR, and Mozilla Thunderbird across the network
  2. Apply security patches to update Firefox to version 149.0 or above, Firefox ESR to 115.34.0 / 140.9.0 or above, and Thunderbird to 140.9.0 / 149.0 or above
  3. Incorporate the policies.json configuration to restrict administrative endpoints in high-security environments
  4. Deploy the 'fission.autostart = true' preference via central group policies to isolate execution domains

References

Read the full report for CVE-2026-4692 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)