CVE-2026-74957

A flaw in the Safe Browsing component of Firefox allows an attacker to circumvent the browser’s protection mechanism, enabling malicious URLs or content to be accessed without triggering the usual safeguards. The vulnerability makes the Safe Browsing checks ineffective, potentially allowing phishing sites or malware downloads that would normally be blocked. Based on the description, the weakness likely involves improper validation of the Safe Browsing parameters, though the exact implementation flaw is not detailed in the alert.

Mozilla Firefox browsers running versions prior to Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1, as well as Mozilla Thunderbird browsers running versions prior to Thunderbird 154, Thunderbird ESR 140.14, and Thunderbird ESR 153.1 are impacted. Users of these releases are at risk until they upgrade to the patched versions where the Safe Browsing bypass is fixed.

The EPSS score remains low (<1%) and the vulnerability is not listed in the CISA KEV catalog, indicating that publicly known exploitation activity is either low or undocumented. The CVSS score of 8.1 indicates high severity, reflecting the importance of the Safe Browsing component. Attackers would need to lure or trick users into visiting affected sites; the direct attack vector is web‑based and could be exercised from any site that a user visits using the default browser configuration. No public exploit code has been reported, but the low EPSS score means the risk remains relatively low, although the high CVSS indicates that if exploited, the impact could be significant to users.