Threat database

CVE-2026-74985 is a critical privilege escalation vulnerability in the Enterprise Policies component of Mozilla Firefox. This flaw allows an attacker to gain elevated privileges within the affected software. The issue was addressed and fixed in Firefox version 154 and Firefox ESR 153.1, as well as Thunderbird 154 and Thunderbird 153.1.

CVE-2026-74984 is a race condition vulnerability in the JavaScript Engine component of Mozilla Firefox. This flaw was addressed and fixed in Firefox version 154 and Firefox ESR 153.1, as well as Thunderbird 154 and Thunderbird 153.1. The vulnerability has a CVSS v3.1 score of 6.8, indicating a medium severity level. It allows an attacker to potentially cause a high impact on confidentiality and integrity but requires high attack complexity and user interaction. No known exploits are reported in the wild at this time.

CVE-2026-74982 is a denial-of-service vulnerability in the Widget component of Mozilla Firefox. This issue was resolved in Firefox version 154 and Firefox ESR 153.1, as well as Thunderbird 154 and Thunderbird 153.1. The vulnerability allows an attacker to cause a denial of service, impacting availability but not confidentiality or integrity.

CVE-2026-74981 is a high-severity site isolation vulnerability in the Audio/Video: Web Codecs component of Mozilla Firefox. It was addressed and fixed in Firefox version 154 and Firefox ESR 153.1, as well as Thunderbird 154 and Thunderbird 153.1. The vulnerability could allow an attacker to bypass site isolation protections, potentially leading to high confidentiality and integrity impacts. No known exploits in the wild have been reported.

CVE-2026-74980 is a clickjacking vulnerability in the Downloads component of Firefox for Android. This issue was addressed and fixed in Firefox version 154. The vulnerability has a medium severity rating with a CVSS score of 6.5. It does not impact confidentiality but can lead to high integrity impact, requiring user interaction for exploitation.

Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

Clickjacking issue in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.

Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2026-74966 is an information disclosure vulnerability in the Form Autofill component of Mozilla Firefox. This flaw could allow unauthorized access to sensitive autofill data. The issue was addressed and fixed in Firefox version 154 and Firefox ESR 153.1, as well as Thunderbird versions 154 and 153.1.

Side-channel in the Web Audio component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

Information disclosure in the WebRTC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2026-74955 is a privilege escalation vulnerability in the Request Handling component of Mozilla Firefox and Thunderbird. This vulnerability allows an attacker to gain elevated privileges. It was fixed in Firefox version 154 and Firefox ESR 153.1, as well as Thunderbird versions 154 and 153.1. The vulnerability has a high severity rating with a CVSS score of 8.8. There are no known exploits in the wild at the time of this advisory.

Information disclosure due to side-channel in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 153.2, and Thunderbird 153.2.

Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154.

CVE-2026-74950 is a privilege escalation vulnerability in the Downloads API component of Mozilla Firefox. This vulnerability allows an attacker to gain elevated privileges. It was fixed in Firefox 154 and Firefox ESR 153.1. The vulnerability has a high severity with a CVSS score of 8.8. No known exploits in the wild have been reported. Users are advised to update to the fixed versions to mitigate this issue.