Red Hat EUVD-2026-14859

The victim must be running Firefox versions earlier than 149 and interact with the vulnerability—likely by visiting a malicious website or opening a crafted file. Remote attacker exploits the IPC component flaw to escalate privileges once Firefox processes the malicious content.

This vulnerability presents a moderate-to-high real-world risk despite missing CVSS and EPSS data. Privilege escalation is consistently ranked as a severe vulnerability class because it enables attackers to transition from limited contexts (e.g., sandboxed content process) to system-level or browser-level control. Firefox's multi-process architecture is specifically designed to isolate security contexts, so any IPC flaw that breaks this isolation is a direct defeat of a core security control. The lack of CVSS and EPSS scores limits quantification, but the vulnerability's inclusion in Mozilla's official security advisory (MFSA2026-20) and the decision to set a hard version floor (Firefox 149) suggests Mozilla assessed this as a meaningful threat. Without confirmation of active exploitation (KEV status unknown) or public proof-of-concept code, the immediate threat is lower than for in-the-wild exploits, but the technical impact (privilege escalation) remains high and the attack complexity is likely low to moderate once an attacker has initial code execution within Firefox's sandbox. Organizations should treat this as a priority patch.

An attacker tricks a user into visiting a malicious website or opening a crafted file, which exploits a separate sandbox-escape or code-execution vulnerability to run arbitrary code within Firefox's sandboxed content process. The attacker then leverages the CVE-2026-4722 IPC flaw to send a specially crafted inter-process message that bypasses access controls, allowing the content process to perform privileged operations (e.g., reading sensitive files, accessing other browser data, or modifying browser configuration) that would normally be restricted to the main process. This transforms a limited sandbox breakout into full browser compromise.