CVE-2026-74957 is a mitigation bypass vulnerability in the Safe Browsing component of Mozilla Firefox and Thunderbird. This vulnerability was addressed and fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. The vulnerability has a high severity rating with a CVSS score of 8.1. It allows an attacker to bypass security mitigations, potentially leading to high confidentiality and integrity impacts. No known exploits in the wild have been reported. Users are advised to update to the fixed versions to remediate this issue.
CVE-2026-74953 is a privilege escalation vulnerability in the Networking: Cookies component of Mozilla Firefox and Thunderbird. This vulnerability allows an attacker to gain elevated privileges within the affected application. It was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. The vulnerability has a high CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. The vendor advisory confirms the availability of official fixes.
Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74948 is an information disclosure vulnerability in the Graphics component of Mozilla Firefox. It was addressed and fixed in Firefox 154 and Firefox ESR versions 115.39, 140.14, and 153.1, as well as corresponding Thunderbird versions. The vulnerability has a medium severity rating with a CVSS score of 6.5. The vendor advisory confirms the fix is available in these versions.
CVE-2026-74946 is a high-severity privilege escalation vulnerability in Mozilla Firefox affecting the Graphics: CanvasWebGL component due to incorrect boundary conditions. This flaw allows an attacker to escalate privileges within the browser environment. The vulnerability was fixed in Firefox 154 and corresponding ESR and Thunderbird versions. No known exploits are reported in the wild. Users should update to the fixed versions to mitigate the risk.
CVE-2026-74945 is an information disclosure vulnerability in the Graphics: Text component of Mozilla Firefox. This flaw allows unauthorized disclosure of information and was addressed in Firefox 154 and corresponding ESR and Thunderbird versions. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. Multiple related security issues were fixed in Firefox 154 and ESR releases 115.39, 140.14, and 153.1. No known exploits in the wild have been reported for this vulnerability.
CVE-2026-74944 is a use-after-free vulnerability in the DOM: Core & HTML component of Mozilla Firefox. This critical security flaw was fixed in Firefox 154 and Firefox ESR versions 140.14 and 153.1. The vulnerability allows for potential high impact on confidentiality, integrity, and availability. It was reported by Amy Burnett of OpenAI and is part of a set of high-impact security issues addressed in these Firefox releases.
CVE-2026-74943 is a critical use-after-free vulnerability in the Graphics: ImageLib component of Mozilla Firefox and Thunderbird. This vulnerability allows for potential memory corruption and was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. Multiple Mozilla security advisories confirm the fix and provide detailed references to the underlying bugs.
CVE-2026-74942 is a high-severity privilege escalation vulnerability in the Remote Settings Client component of Mozilla Firefox and Thunderbird. It was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. The vulnerability allows an unprivileged user to escalate privileges, potentially leading to full compromise of the affected application. Multiple related security advisories from Mozilla confirm the fix and provide additional context on other vulnerabilities addressed in the same releases.
CVE-2026-74941 is a high severity privilege escalation vulnerability in the Graphics: CanvasWebGL component of Mozilla Firefox. It was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. The vulnerability allows an attacker to escalate privileges within the affected component. Mozilla has released official fixes for this issue as part of their security advisories announced on August 18, 2026.
CVE-2026-74940 is a critical use-after-free vulnerability in the Graphics: Text component of Mozilla Firefox. This flaw allows for potential memory corruption leading to high impact on confidentiality, integrity, and availability. The vulnerability was fixed in Firefox 154 and corresponding ESR and Thunderbird versions. No known exploits are reported in the wild at this time.
CVE-2026-74939 is a high-severity privilege escalation vulnerability in the DOM Navigation component of Mozilla Firefox. It allows an unprivileged user interface action to escalate privileges within the browser. This vulnerability was fixed in Firefox 154 and Firefox ESR versions 115.39, 140.14, and 153.1, as well as corresponding Thunderbird versions. The vulnerability has a CVSS score of 8.8, indicating high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. Mozilla has officially patched this issue.
CVE-2026-74936 is a critical use-after-free vulnerability in the JavaScript WebAssembly component of Mozilla Firefox. This flaw allows for potential memory corruption and was fixed in Firefox 154 and Firefox ESR versions 140.14 and 153.1. The vulnerability has a CVSS score of 9.8, indicating high severity with network attack vector, no required privileges or user interaction, and impacts confidentiality, integrity, and availability. No known exploits in the wild have been reported. The vendor has released official patches to address this issue.
CVE-2026-74935 is a high-severity privilege escalation vulnerability in the DOM Networking component of Mozilla Firefox. It allows an unprivileged attacker to escalate privileges within the browser environment. This vulnerability was fixed in Firefox 154 and Firefox ESR versions 115.39, 140.14, and 153.1, as well as corresponding Thunderbird versions. The vulnerability has a CVSS score of 8.8, indicating a critical impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. Users are advised to update to the fixed versions to mitigate the risk.
CVE-2026-74934 is a high-severity vulnerability in Mozilla Firefox affecting the Graphics: CanvasWebGL component related to site isolation. This issue was fixed in Firefox 154 and corresponding ESR versions 115.39, 140.14, and 153.1. The vulnerability could lead to significant confidentiality, integrity, and availability impacts. No known exploits in the wild have been reported. Mozilla has released official fixes for this vulnerability.
CVE-2026-18809 is an information disclosure vulnerability affecting Firefox for Android and Firefox Focus for Android. The flaw could allow unauthorized disclosure of sensitive information. Mozilla fixed this vulnerability in Firefox version 153.0.3. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. No known exploits are reported in the wild. Users are advised to update to the fixed version to mitigate the risk.
The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13.
CVE-2026-16349 is a critical vulnerability in Mozilla Firefox involving a same-origin policy bypass in the DOM Navigation component. This flaw allows unauthorized access across origins, violating web security boundaries. The issue was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. Users should update to the fixed versions to mitigate the risk.
Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.
Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.