CVE-2026-75874

Published: Aug 18, 2026Modified: Sep 1, 2026

10.0

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 6.0

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 140.15, and Thunderbird 153.2.

Affected (2)

Products: Mozilla: Firefox, Thunderbird

Mozilla

2 products

Firefox

Thunderbird

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Before 154.0.0
Mozilla Thunderbird	Before 154.0

Related CWEs

CWE-693

Protection Mechanism Failure

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

References (8)

https://bugzilla.mozilla.org/show_bug.cgi?id=2039972

Source: security@mozilla.org

Permissions Required

https://www.mozilla.org/security/advisories/mfsa2026-74/

Source: security@mozilla.org

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2026-78/

Source: security@mozilla.org

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2026-83/

Source: security@mozilla.org

https://www.mozilla.org/security/advisories/mfsa2026-84/

Source: security@mozilla.org

https://www.mozilla.org/security/advisories/mfsa2026-85/

Source: security@mozilla.org

https://www.mozilla.org/security/advisories/mfsa2026-87/

Source: security@mozilla.org

https://www.mozilla.org/security/advisories/mfsa2026-88/

Source: security@mozilla.org

Timeline

No history available yet.