CVE-2026-74936 - Vulnerability Details

- Use-after-free in the JavaScript: WebAssembly component

Description

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Published: 2026-08-18

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Use‑after‑free flaw in the JavaScript: WebAssembly component allows an attacker to corrupt memory or execute arbitrary code after the object is prematurely freed. This can lead to remote code execution and full system compromise in privileged browser contexts. The issue is mapped to CWE‑416 and CWE‑825.

Affected Systems

Firefox releases prior to 154, and the ESR 140.14 and 153.1 versions, as well as Thunderbird versions older than 154, including the ESR 140.14 and 153.1 releases, remain vulnerable. All newer builds contain the fix.

Risk and Exploitability

The CVSS score of 9.8 marks the flaw as critical, yet the EPSS score of < 1 % suggests a very low current exploitation likelihood. The vulnerability is not listed in CISA’s KEV catalog and no public exploits are known. Based on the description, the likely attack vector involves malicious JavaScript or WebAssembly content served from an attacker‑controlled web site, a scenario that has been inferred from the component’s function.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mozilla

Firefox

affected

Version	Status	Constraints
`140.14`	unaffected	≤ 140.*
`153.1`	unaffected	≤ 153.*
`154`	unaffected	≤ *

Mozilla

Thunderbird

affected

Version	Status	Constraints
`140.14`	unaffected	≤ 140.*
`153.1`	unaffected	≤ 153.*
`154`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:a:mozilla:firefox::::::::
	cpe:2.3:a:mozilla:firefox::::::::
	cpe:2.3:a:mozilla:thunderbird::::::::
	cpe:2.3:a:mozilla:thunderbird::::::::

No data.

Vendor Product Confidence Versions

Mozilla

Firefox

100%

Version	Status	Scheme	Platform
`[140.14,140.*]`	unaffected	generic	—
`[153.1,153.*]`	unaffected	generic	—
`[154,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to Firefox 154, Firefox ESR 140.14 or 153.1, or to Thunderbird 154, Thunderbird ESR 140.14 or 153.1, which contain the fix.
If an upgrade cannot be performed immediately, configure the browser to disable or block WebAssembly so the vulnerable component cannot execute.
Maintain a regular update schedule and ensure all browsers receive security patches as soon as they are available.

Generated by OpenCVE AI on August 21, 2026 at 18:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4750-1	firefox-esr security update
Debian DLA	DLA-4754-1	thunderbird security update
Debian DSA	DSA-6451-1	firefox-esr security update
Debian DSA	DSA-6461-1	thunderbird security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00403.

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=2052688
https://nvd.nist.gov/vuln/detail/CVE-2026-74936
https://www.cve.org/CVERecord?id=CVE-2026-74936
https://www.mozilla.org/security/advisories/mfsa2026-74/
https://www.mozilla.org/security/advisories/mfsa2026-76/
https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74936
https://www.mozilla.org/security/advisories/mfsa2026-77/
https://www.mozilla.org/security/advisories/mfsa2026-78/
https://www.mozilla.org/security/advisories/mfsa2026-79/
https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74936
https://www.mozilla.org/security/advisories/mfsa2026-80/

History

Fri, 21 Aug 2026 21:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 20 Aug 2026 21:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mozilla thunderbird
CPEs		cpe:2.3:a:mozilla:firefox:::::::: cpe:2.3:a:mozilla:thunderbird::::::::
Vendors & Products		Mozilla thunderbird
Metrics	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Wed, 19 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-74936 https://www.cve.org/CVERecord?id=CVE-2026-74936 https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74936 https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74936
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}` threat_severity `Important`

Tue, 18 Aug 2026 21:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Tue, 18 Aug 2026 19:00:00 +0000

Type	Values Removed	Values Added
Description	Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1.	Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
References		https://www.mozilla.org/security/advisories/mfsa2026-78/ https://www.mozilla.org/security/advisories/mfsa2026-79/ https://www.mozilla.org/security/advisories/mfsa2026-80/

Tue, 18 Aug 2026 13:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla firefox
Vendors & Products		Mozilla Mozilla firefox

Tue, 18 Aug 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1.
Title		Use-after-free in the JavaScript: WebAssembly component
References		https://bugzilla.mozilla.org/show_bug.cgi?id=2052688 https://www.mozilla.org/security/advisories/mfsa2026-74/ https://www.mozilla.org/security/advisories/mfsa2026-76/ https://www.mozilla.org/security/advisories/mfsa2026-77/

Subscriptions

Mozilla Firefox Thunderbird

MITRE

Status: PUBLISHED

Assigner: mozilla

Published: 2026-08-18T12:23:27.882Z

Updated: 2026-08-21T20:11:20.026Z

Reserved: 2026-08-17T11:57:29.210Z

Link: CVE-2026-74936

Vulnrichment

Updated: 2026-08-21T20:11:14.754Z

NVD

Status : Modified

Published: 2026-08-18T13:17:29.850

Modified: 2026-08-21T21:17:05.290

Link: CVE-2026-74936

Redhat

Severity : Important

Publid Date: 2026-08-18T12:23:27Z

Links: CVE-2026-74936 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-21T18:45:04Z

Weaknesses

CWE-416
Use After Free
CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object