CVE-2026-74965 - Vulnerability Details

- Privilege escalation in the Shell Integration component

Description

Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Published: 2026-08-18

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability resides in the Shell Integration component of Mozilla Firefox and Thunderbird and permits an attacker to gain higher privileges than normally allowed; by exploiting this flaw, an attacker could execute arbitrary code or modify system settings that require elevated rights, effectively bypassing the normal privilege boundary.

Affected Systems

Mozilla Firefox releases 154, ESR 140.14, and ESR 153.1, and Mozilla Thunderbird releases 154, ESR 140.14, and ESR 153.1 contain the fix; all earlier releases of either product are vulnerable.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves the Shell Integration feature, which handles file associations and command execution requests within the Windows environment. A malicious actor who can supply a specially crafted shell integration file or trigger its processing may cause the component to execute privileged operations with the process’s rights. Users on older releases of either Firefox or Thunderbird should upgrade promptly to eliminate the risk.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mozilla

Firefox

affected

Version	Status	Constraints
`140.14`	unaffected	≤ 140.*
`153.1`	unaffected	≤ 153.*
`154`	unaffected	≤ *

Mozilla

Thunderbird

affected

Version	Status	Constraints
`140.14`	unaffected	≤ 140.*
`153.1`	unaffected	≤ 153.*
`154`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:a:mozilla:firefox:::::esr:::*
	cpe:2.3:a:mozilla:firefox:::::-:::*
	cpe:2.3:a:mozilla:firefox:153.0::::esr:::
	cpe:2.3:a:mozilla:thunderbird:::::esr:::*
	cpe:2.3:a:mozilla:thunderbird:::::-:::*
	cpe:2.3:a:mozilla:thunderbird:::::esr:::*

No data.

Vendor Product Confidence Versions

Mozilla

Firefox

100%

Version	Status	Scheme	Platform
`[140.14,141.0.0)`	unaffected	generic	—
`[153.1,154.0.0)`	unaffected	generic	—
`[154,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade Mozilla Firefox to version 154 or a later ESR release such as 140.14 or 153.1.
Upgrade Mozilla Thunderbird to version 154 or a later ESR release such as 140.14 or 153.1.
If an upgrade is not possible immediately, disable the Shell Integration feature or file association handling to reduce the attack surface.

Generated by OpenCVE AI on August 21, 2026 at 18:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4750-1	firefox-esr security update
Debian DLA	DLA-4754-1	thunderbird security update
Debian DSA	DSA-6451-1	firefox-esr security update
Debian DSA	DSA-6461-1	thunderbird security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00297.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=2053455
https://nvd.nist.gov/vuln/detail/CVE-2026-74965
https://www.cve.org/CVERecord?id=CVE-2026-74965
https://www.mozilla.org/security/advisories/mfsa2026-74/
https://www.mozilla.org/security/advisories/mfsa2026-76/
https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74965
https://www.mozilla.org/security/advisories/mfsa2026-77/
https://www.mozilla.org/security/advisories/mfsa2026-78/
https://www.mozilla.org/security/advisories/mfsa2026-79/
https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74965
https://www.mozilla.org/security/advisories/mfsa2026-80/

History

Wed, 19 Aug 2026 01:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mozilla thunderbird
CPEs		cpe:2.3:a:mozilla:firefox:::::-:::* cpe:2.3:a:mozilla:firefox:::::esr:::* cpe:2.3:a:mozilla:firefox:153.0::::esr::: cpe:2.3:a:mozilla:thunderbird:::::-:::* cpe:2.3:a:mozilla:thunderbird:::::esr:::*
Vendors & Products		Mozilla thunderbird

Wed, 19 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-266
References		https://nvd.nist.gov/vuln/detail/CVE-2026-74965 https://www.cve.org/CVERecord?id=CVE-2026-74965 https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74965 https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74965
Metrics	threat_severity `None`	threat_severity `Moderate`

Tue, 18 Aug 2026 19:00:00 +0000

Type	Values Removed	Values Added
Description	Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1.	Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
References		https://www.mozilla.org/security/advisories/mfsa2026-78/ https://www.mozilla.org/security/advisories/mfsa2026-79/ https://www.mozilla.org/security/advisories/mfsa2026-80/

Tue, 18 Aug 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 18 Aug 2026 14:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-269

Tue, 18 Aug 2026 14:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla firefox
Vendors & Products		Mozilla Mozilla firefox

Tue, 18 Aug 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1.
Title		Privilege escalation in the Shell Integration component
References		https://bugzilla.mozilla.org/show_bug.cgi?id=2053455 https://www.mozilla.org/security/advisories/mfsa2026-74/ https://www.mozilla.org/security/advisories/mfsa2026-76/ https://www.mozilla.org/security/advisories/mfsa2026-77/

Subscriptions

Mozilla Firefox Thunderbird

MITRE

Status: PUBLISHED

Assigner: mozilla

Published: 2026-08-18T12:23:32.613Z

Updated: 2026-08-21T03:55:30.343Z

Reserved: 2026-08-17T11:58:33.288Z

Link: CVE-2026-74965

Vulnrichment

Updated: 2026-08-18T15:36:39.496Z

NVD

Status : Analyzed

Published: 2026-08-18T13:17:33.813

Modified: 2026-08-21T04:18:18.987

Link: CVE-2026-74965

Redhat

Severity : Moderate

Publid Date: 2026-08-18T12:23:32Z

Links: CVE-2026-74965 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-21T19:00:13Z

Weaknesses

CWE-266
Incorrect Privilege Assignment
CWE-269
Improper Privilege Management

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object