CVE-2026-74989

Internally found bugs fixed in Firefox 154

View on CVE.org
Published Aug 18, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Description
Internally found bugs present in Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154 and Thunderbird 154.

Analysis

AI-generated

Technical impact

Internally discovered bugs in Firefox 153 can cause memory corruption or other security‑relevant defects. The vendor believes these could be exploited with sufficient effort, potentially allowing arbitrary code execution. The vulnerability was addressed in Firefox 154.

Affected Systems

Mozilla Firefox version 153 is affected. Users of Firefox 154 or later are not impacted. Mozilla Thunderbird versions 154 or later are not affected. The advisories state that the bugs were fixed in Thunderbird 154, but the input does not explicitly confirm that earlier Thunderbird versions are affected.

Risk and Exploitability

The CVSS score of 9.8 indicates a very high severity. The EPSS score of less than 1% indicates a low likelihood of exploitation in the wild, though a dedicated attacker could still target these flaws. The vulnerability involves memory corruption; the exact method of exploitation is not documented, but the nature of the bugs suggests a potential memory corruption that could be triggered by malicious input. The flaw is not listed in the CISA KEV catalog.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Mozilla Firefox and Thunderbird to version 154 or later as soon as possible.
  • If upgrading is not feasible immediately, disable or remove untrusted extensions and add‑ons to reduce the attack surface.
  • Consider running the browser within a sandboxed environment or with limited privileges until a patch is applied.

Generated by OpenCVE AI on October 28, 2026 at 19:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description Internally found bugs present in Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154 and Thunderbird 154. Internally found bugs present in Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154 and Thunderbird 154.
Title Internally found bugs fixed in Thunderbird 154 Internally found bugs fixed in Firefox 154
Type Values Removed Values Added
Description Internally found bugs present in Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154 and Thunderbird 154. Internally found bugs present in Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154 and Thunderbird 154.
Title Internally found bugs fixed in Firefox 154 Internally found bugs fixed in Thunderbird 154
Type Values Removed Values Added
Description Internally found bugs present in Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154 and Thunderbird 154. Internally found bugs present in Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154 and Thunderbird 154.
Title Internally found bugs fixed in Thunderbird 154 Internally found bugs fixed in Firefox 154
Type Values Removed Values Added
First Time appeared Mozilla thunderbird
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
Vendors & Products Mozilla thunderbird
Type Values Removed Values Added
Weaknesses CWE-119
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Weaknesses CWE-125
CWE-787
Type Values Removed Values Added
Description Internally found bugs present in Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154. Internally found bugs present in Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154 and Thunderbird 154.
Title Internally found bugs fixed in Firefox 154 Internally found bugs fixed in Thunderbird 154
References
Type Values Removed Values Added
Weaknesses CWE-125
CWE-787
Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox
Type Values Removed Values Added
Description Internally found bugs present in Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154.
Title Internally found bugs fixed in Firefox 154
References
Earlier changes (6)
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-825

    Expired Pointer Dereference

Sources

Status
PUBLISHED
Assigner
mozilla
Published
Updated
Oct 28, 2026, 4:36 PM
Reserved
Aug 17, 2026, 11:59 AM

View source JSON

Updated
Aug 20, 2026, 3:51 PM

JSON

Status
Modified
Published
Aug 18, 2026, 1:17 PM
Modified
Oct 28, 2026, 5:18 PM

View source JSON

Severity
Moderate
Public date
Aug 18, 2026, 12:23 PM

View source Bugzilla JSON

Updated
Oct 28, 2026, 7:30 PM

JSON