CVE-2026-75874 is a sandbox escape vulnerability in the Remote Settings Client component of Mozilla Firefox. The flaw allows an attacker to escape the sandbox protections, which are designed to isolate browser processes and limit the impact of exploits. This vulnerability was addressed and fixed in Firefox 154, Thunderbird 154, and Firefox ESR versions 115.40, 140.15, and 153.2. The vulnerability has a CVSS v3.1 base score of 10.0, reflecting critical severity with network attack vector, no privileges or user interaction required, and complete compromise of confidentiality, integrity, and availability. The vendor advisory confirms the fix and recommends updating to the fixed versions.

Successful exploitation of this vulnerability could allow an attacker to escape the sandbox environment in Firefox, potentially leading to full system compromise including arbitrary code execution with elevated privileges. The vulnerability is critical with a CVSS score of 10.0, indicating it can be exploited remotely without user interaction or privileges, resulting in complete loss of confidentiality, integrity, and availability of the affected system.

Mozilla has released official fixes for this vulnerability in Firefox 154, Thunderbird 154, and Firefox ESR versions 115.40, 140.15, and 153.2. Users and administrators should update affected products to these versions or later to remediate the vulnerability. There are no vendor advisories indicating any temporary mitigations or that no action is required. Patch status is confirmed as fixed in the specified versions.