CVE-2026-74940: Vulnerability in Mozilla Firefox
CVE-2026-74940 is a critical use-after-free vulnerability in the Graphics: Text component of Mozilla Firefox. This flaw allows for potential memory corruption leading to high impact on confidentiality, integrity, and availability. The vulnerability was fixed in Firefox 154 and corresponding ESR and Thunderbird versions. No known exploits are reported in the wild at this time.
AI Analysis
Technical Summary
CVE-2026-74940 is a use-after-free vulnerability affecting the Graphics: Text component in Mozilla Firefox. This memory corruption issue could allow an attacker to execute arbitrary code or cause a denial of service. The vulnerability is addressed in Firefox 154, Firefox ESR 115.39, 140.14, 153.1, and Thunderbird versions 154, 140.14, and 153.1. The Mozilla advisories confirm the fix and classify the impact as high. There are no known active exploits in the wild for this vulnerability.
Potential Impact
The vulnerability can lead to complete compromise of confidentiality, integrity, and availability of the affected Firefox browser due to use-after-free memory corruption. This could allow remote attackers to execute arbitrary code without user interaction. The CVSS v3.1 score is 9.8 (critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Mozilla has released official fixes for this vulnerability in Firefox 154, Firefox ESR 115.39, 140.14, 153.1, and Thunderbird 154, 140.14, and 153.1. Users and administrators should update to these fixed versions or later to mitigate the risk. No additional mitigation steps are required beyond applying these official updates.
CVE-2026-74940: Vulnerability in Mozilla Firefox
Description
CVE-2026-74940 is a critical use-after-free vulnerability in the Graphics: Text component of Mozilla Firefox. This flaw allows for potential memory corruption leading to high impact on confidentiality, integrity, and availability. The vulnerability was fixed in Firefox 154 and corresponding ESR and Thunderbird versions. No known exploits are reported in the wild at this time.
CVSS v3.1
Score 9.8critical
Affected software
Mozilla
Firefox
Mozilla
Thunderbird
pkg:github/mozilla/firefoxRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-74940 is a use-after-free vulnerability affecting the Graphics: Text component in Mozilla Firefox. This memory corruption issue could allow an attacker to execute arbitrary code or cause a denial of service. The vulnerability is addressed in Firefox 154, Firefox ESR 115.39, 140.14, 153.1, and Thunderbird versions 154, 140.14, and 153.1. The Mozilla advisories confirm the fix and classify the impact as high. There are no known active exploits in the wild for this vulnerability.
Potential Impact
The vulnerability can lead to complete compromise of confidentiality, integrity, and availability of the affected Firefox browser due to use-after-free memory corruption. This could allow remote attackers to execute arbitrary code without user interaction. The CVSS v3.1 score is 9.8 (critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Mozilla has released official fixes for this vulnerability in Firefox 154, Firefox ESR 115.39, 140.14, 153.1, and Thunderbird 154, 140.14, and 153.1. Users and administrators should update to these fixed versions or later to mitigate the risk. No additional mitigation steps are required beyond applying these official updates.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mozilla
- Date Reserved
- 2026-08-17T11:57:37.997Z
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://www.mozilla.org/security/advisories/mfsa2026-74/","vendor":"Mozilla"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-75/","vendor":"Mozilla"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-76/","vendor":"Mozilla"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-77/","vendor":"Mozilla"}]
Threat ID: 6a845502c6e8be03323673a3
Added to database: 08/18/2026, 12:50:10 UTC
Last enriched: 09/11/2026, 22:03:48 UTC
Last updated: 10/03/2026, 02:46:06 UTC
Views: 56
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.