CVE-2026-74990 covers a set of internally discovered vulnerabilities in Mozilla Firefox and Thunderbird, including versions Firefox ESR 115.38 and earlier, ESR 140.13 and earlier, ESR 153.0, and Firefox 153. These bugs involve memory corruption and other security-relevant defects, some of which could have been exploited with sufficient effort. The vulnerabilities were addressed and fixed in Firefox 154, Firefox ESR 115.39, 140.14, 153.1, and Thunderbird versions 154, 140.14, and 153.1. The CVSS 3.1 base score is 9.8 (critical), indicating high impact on confidentiality, integrity, and availability. The vendor advisories detail multiple related bugs affecting various components such as Graphics, DOM, JavaScript engine, and networking. No known exploits in the wild have been reported at this time.

The vulnerabilities present in affected Firefox and Thunderbird versions could allow remote attackers to achieve high-impact outcomes including full compromise of confidentiality, integrity, and availability of the affected software. The issues include memory corruption and privilege escalation, which could lead to arbitrary code execution or sandbox escape. The critical CVSS score reflects the severity of these defects. However, no active exploitation has been observed in the wild so far.

Mozilla has released official fixes for these vulnerabilities in Firefox 154, Firefox ESR 115.39, 140.14, 153.1, and corresponding Thunderbird versions 154, 140.14, and 153.1. Users and administrators should update to these fixed versions immediately to mitigate the risk. Since this is not a cloud service, patching the client software is required. Patch status is confirmed by the vendor advisories linked. No additional mitigation steps are indicated beyond applying these updates.