CVE-2026-74987 encompasses a set of internally discovered bugs in Mozilla Firefox and Thunderbird versions ESR 140.13, ESR 153.0, and 153. These bugs include memory corruption and other security-relevant defects that could potentially be exploited. The vulnerabilities affect multiple components such as graphics (CanvasWebGL, ImageLib, Text), JavaScript engine (WebAssembly, GC), DOM (Networking, Navigation, Core & HTML), sandbox escape, privilege escalation, information disclosure, mitigation bypass, and same-origin policy bypass. Mozilla released fixes in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1 to address these issues. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

The vulnerabilities collectively pose a critical risk, potentially allowing remote attackers to execute arbitrary code, escalate privileges, bypass security mitigations, disclose sensitive information, or escape sandbox restrictions. The high CVSS score reflects the severity and ease of exploitation without user interaction or privileges. However, no active exploitation in the wild has been reported at this time.

Mozilla has officially fixed these vulnerabilities in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1. Users and administrators should update to these fixed versions or later to mitigate the risk. Since this is not a cloud service, remediation depends on applying these official patches. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching.