Red Hat CVE-2026-4725

Remote unauthenticated attacker delivers malicious webpage to Firefox browser versions prior to 149. Victim must visit the crafted page; no user interaction beyond normal browsing required. Canvas2D graphics rendering is enabled by default.

Despite the absence of a CVSS score, EPSS probability, or KEV listing at the time of initial disclosure, this vulnerability presents high real-world risk based on technical characteristics. The use-after-free defect in a core rendering component combined with sandbox escape capability indicates both exploitability and severe impact. No publicly available proof-of-concept has been confirmed in the intelligence provided, which may reflect the responsible disclosure timeline. The sandbox escape classification elevates this beyond typical memory corruption issues, as it potentially enables local privilege escalation or full system compromise. Given Firefox's large user base and the critical nature of graphics-component vulnerabilities, this warrants immediate prioritization regardless of scoring delays.

An attacker crafts a malicious web page that exploits the use-after-free vulnerability through specially crafted Canvas2D drawing operations. When a user visits the page with a vulnerable Firefox browser, the memory corruption allows the attacker to read sensitive data from the browser process or corrupt heap structures. This enables the attacker to break out of Firefox's sandbox isolation and gain code execution at the browser process privilege level, potentially allowing further system compromise. No public proof-of-concept is confirmed, but the vulnerability's nature suggests it is likely to be discovered or exploited once patch deployment lags significantly.