Threat database

CVE-2026-74947 is a high-severity privilege escalation vulnerability in Mozilla Firefox caused by an invalid pointer in the Graphics component. This flaw allows an attacker to escalate privileges within the affected application. The vulnerability was fixed in Firefox version 154 and Firefox ESR 153.1.

Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 140.15, and Thunderbird 153.2.

Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Mitigation bypass in the Data Loss Prevention component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

CVE-2026-74976 is a low severity vulnerability involving JIT miscompilation in the JavaScript Engine's JIT component of Mozilla Firefox. This issue was fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1. The vulnerability does not have known exploits in the wild and affects versions prior to these fixed releases.

Same-origin policy bypass in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Race condition, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Information disclosure in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Information disclosure in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

CVE-2026-74969 is a use-after-free vulnerability in the Layout: Text and Fonts component of Mozilla Firefox. This security flaw was addressed and fixed in Firefox 154 and corresponding ESR and Thunderbird versions. The vulnerability has a high severity rating with a CVSS score of 8.8, indicating it could lead to significant impact if exploited. No known exploits are reported in the wild. Users should update to the fixed versions to mitigate the risk.

Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

CVE-2026-74965 is a privilege escalation vulnerability in the Shell Integration component of Mozilla Firefox and Thunderbird. This vulnerability allows an attacker to gain elevated privileges. It was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. The vulnerability has a high severity with a CVSS score of 8.8. No known exploits in the wild have been reported. The vendor has released official fixes for the affected versions.

An integer overflow vulnerability exists in the Graphics component of Mozilla Firefox. This vulnerability has been fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. The vulnerability is rated critical with a CVSS score of 9.8. The vendor advisory confirms the availability of official fixes in the specified versions.

Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

CVE-2026-74962 is a site isolation vulnerability in the Networking: Cookies component of Mozilla Firefox. This issue was addressed and fixed in Firefox version 154 and corresponding ESR versions 140.14 and 153.1. The vulnerability has a high CVSS score of 8.1 and could allow an attacker to bypass site isolation protections related to cookies. No known exploits are reported in the wild. The fix is officially available in the stated Firefox versions.

CVE-2026-74960 is a site isolation vulnerability in the WebExtensions component of Mozilla Firefox. This issue was addressed and fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1. The vulnerability has a high severity rating with a CVSS score of 8.1. It allows an attacker to bypass site isolation protections, potentially leading to high impact on confidentiality and integrity. No known exploits in the wild have been reported. Users of affected versions should upgrade to the fixed versions to mitigate the risk.

CVE-2026-74959 is a mitigation bypass vulnerability in the Storage: Cache API component of Mozilla Firefox. It was fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1. The vulnerability has a high CVSS score of 9.1, indicating critical severity. The vendor advisory confirms the fix is available in these versions. No known exploits in the wild have been reported.