## Summary
Mozilla Firefox and Thunderbird contain a privilege escalation flaw in the IPC component (CVE-2026-4722). The issue was fixed in Firefox 149 and Thunderbird 149.
## Technical Details
The root cause relates to insufficient validation when receiving handles for BrowsingContext/WindowContext from a different BCG (BrowsingContext Group). Mozilla notes that in Bug 2008912 they were fixing validation for normal IPC messages, but CVE-2026-4722 also involves sending BrowsingContext objects over IPC within ClonedMessageData.
In this path, the serialized StructuredClone buffer stores the data inline, so the deserialization step “doesn't know the origin process.” As a result, the system cannot easily validate that the receiving process is aware of the specific BCG associated with the received handle. Mozilla indicates that fixing this likely requires additional provenance information.
## Affected
- mozilla firefox < 149.0
- Firefox 149 (fixed)
- Thunderbird 149 (fixed)
## Impact
- Privilege escalation in the IPC component
- CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack vector is NETWORK
- Mozilla advisory notes these flaws are potentially risky in “browser or browser-like contexts.”
## Mitigation
1. Upgrade to Firefox 149.
2. Upgrade to Thunderbird 149.
3. If upgrading is not immediately possible, reduce exposure by limiting untrusted network interactions in the affected browser/browser-like context.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD-CWE-noinfo