Description
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
Published: 2026-08-18
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A use‑after‑free flaw was discovered in the JavaScript garbage collector. The advisory does not detail the exact consequences, but typical use‑after‑free bugs in a browser’s JavaScript engine enable memory corruption that can lead to arbitrary code execution. The problem was addressed in Firefox 154 and the corresponding ESR branch 153.1, and also in Thunderbird 154 and 153.1.

Affected Systems

Affected releases are all versions of Mozilla Firefox and Firefox ESR prior to 154 and 153.1, respectively, and all Thunderbird releases prior to 154 and 153.1. The advisory does not list any other affected version ranges.

Risk and Exploitability

The CVSS score is 8.8 and the EPSS score is 0.00292 (approximately 0.3%). The vulnerability is not currently listed in the CISA KEV catalog. Attackers would need to deliver malicious JavaScript – for example via a compromised or malicious website – to trigger the use‑after‑free. Considering typical browser exploitation trends, the risk of exploitation is significant, especially if a user visits an untrusted site or executes injected code.

Generated by OpenCVE AI on August 21, 2026 at 18:08 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Mozilla Firefox to version 154 or newer, or upgrade the ESR channel to version 153.1 or newer.
  • Configure the browser to auto‑update to receive the fixed version as soon as it is released.
  • If an update cannot be applied immediately, temporarily disable JavaScript or employ a content blocker to mitigate the execution of malicious scripts.

Generated by OpenCVE AI on August 21, 2026 at 18:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 19 Aug 2026 01:15:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla thunderbird
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*
Vendors & Products Mozilla thunderbird

Tue, 18 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 18 Aug 2026 19:00:00 +0000

Type Values Removed Values Added
Description Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 154 and Firefox ESR 153.1. Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
References

Tue, 18 Aug 2026 13:45:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Weaknesses CWE-416
Vendors & Products Mozilla
Mozilla firefox

Tue, 18 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Description Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 154 and Firefox ESR 153.1.
Title Use-after-free in the JavaScript: GC component
References

Subscriptions

Mozilla Firefox Thunderbird
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-08-18T19:21:21.914Z

Reserved: 2026-08-17T11:57:31.254Z

Link: CVE-2026-74937

cve-icon Vulnrichment

Updated: 2026-08-18T19:18:55.317Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T13:17:29.950

Modified: 2026-08-19T00:58:37.713

Link: CVE-2026-74937

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-18T12:23:35Z

Links: CVE-2026-74937 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T18:15:04Z

Weaknesses