CVE-2026-74944 Mozilla CVE debrief

Who should care

Users of Mozilla Firefox, Thunderbird, and other affected products should apply patches to prevent exploitation of this critical vulnerability. Affected product deployments should be reviewed for exposure, and compensating controls should be considered while remediation is scheduled. Security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Vulnerability management and security teams should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Operators of affected platforms should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Monitoring, detection, and logs for exposed assets should be reviewed for extra review. Asset inventory and change management processes should be updated to reflect the remediation status of affected systems. Source tracking and exposure review should be performed to ensure that all affected systems are accounted for and remediated. Compensating controls should be reviewed and updated as necessary to protect against exploitation. Rollback and change windows should be planned and executed to minimize downtime and ensure that remediation is completed in a timely manner. Security teams should also review and update their incident response plans to include procedures for responding to exploitation of this vulnerability. The CVE record was published on 2026-08-18T13:17:30.983Z and has not been modified since then. The CVSS score is 9.8, indicating critical severity. The vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. The vulnerability affects multiple Mozilla products, and users should apply patches to prevent exploitation. The CVE-2026-74944 vulnerability is a use-after-free issue in the DOM: Core & HTML component of Mozilla products, including Firefox and Thunderbird. This critical vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. Users should apply patches to prevent exploitation. The CVE-

Technical summary

The CVE-2026-74944 vulnerability is a use-after-free issue in the DOM: Core & HTML component of Mozilla products, including Firefox and Thunderbird. This vulnerability has a CVSS score of 9.8, indicating critical severity. It was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. The vulnerability affects multiple Mozilla products, and users should apply patches to prevent exploitation.

Defensive priority

Critical vulnerability in Mozilla products

Recommended defensive actions

• Apply patches from Mozilla for affected products
• Update Firefox to version 154 or later
• Update Thunderbird to version 154 or later
• Update Firefox ESR to version 140.14 or 153.1 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE-2026-74944 vulnerability is a use-after-free issue in the DOM: Core & HTML component of Mozilla products. It was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. The CVSS score is 9.8, indicating critical severity.

Official resources