CVE-2026-74936: Firefox WebAssembly Use-After-Free Flaw

CVE-2026-74936 Overview

CVE-2026-74936 is a use-after-free vulnerability in the JavaScript WebAssembly component shared by Mozilla Firefox and Thunderbird. The flaw allows a remote attacker to trigger memory corruption when a targeted user loads attacker-controlled web content or renders a malicious HTML email. Mozilla addressed the issue in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. The vulnerability is tracked under CWE-416 and reaches remote attackers over the network without authentication or user interaction beyond visiting a page.

Critical Impact
Remote code execution in the browser or mail client through a crafted WebAssembly payload, with full loss of confidentiality, integrity, and availability of the affected process.

Affected Products

Mozilla Firefox versions prior to 154
Mozilla Firefox ESR versions prior to 140.14 and 153.1
Mozilla Thunderbird versions prior to 154, 140.14, and 153.1

Discovery Timeline

2026-08-18 - CVE-2026-74936 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-74936

Vulnerability Analysis

The vulnerability resides in the WebAssembly (Wasm) subsystem of the SpiderMonkey JavaScript engine used by Firefox and Thunderbird. A use-after-free condition (CWE-416) occurs when the engine continues to reference a memory object after it has already been released. An attacker who controls the Wasm module or its interaction with JavaScript can reclaim the freed allocation and steer subsequent operations against attacker-chosen data.

Because the affected code path runs inside the content process, successful exploitation grants execution in the context of the renderer. Chaining with a sandbox escape would extend impact to the host operating system.

Root Cause

The root cause is improper lifetime management of an object within the WebAssembly component. Referenced Mozilla bug tracking is available in the Mozilla Bugzilla Entry #2052688, and remediation details are documented across advisories including the Mozilla Security Advisory MFSA-2026-74 and Mozilla Security Advisory MFSA-2026-76.

Attack Vector

Exploitation requires the victim to load attacker-controlled content that instantiates a crafted WebAssembly module. In Firefox this is any visited web page. In Thunderbird, remote content rendering within a message or embedded browsing context can reach the same code path. No credentials are required, and the attack is scriptable at scale via drive-by delivery, malvertising, or watering-hole techniques.

No public proof-of-concept is currently referenced, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. The verified technical details are described in the Mozilla Bugzilla Entry #2052688.

Detection Methods for CVE-2026-74936

Indicators of Compromise

Firefox or Thunderbird content processes crashing with signatures referencing js::wasm or SpiderMonkey Wasm frames.
Unexpected child process creation from firefox.exe or thunderbird.exe, such as command shells or scripting hosts.
Outbound connections from browser or mail client processes to newly registered or low-reputation domains immediately after page load.

Detection Strategies

Inventory endpoints running Firefox and Thunderbird and compare installed versions against Firefox 154, Firefox ESR 140.14/153.1, and matching Thunderbird builds.
Alert on abnormal parent-child relationships where the browser or mail client spawns interpreters, LOLBins, or persistence utilities.
Correlate browser crash telemetry with subsequent process, file, and network activity on the same host.

Monitoring Recommendations

Ingest endpoint process, file, and network telemetry into a centralized data lake to enable retrospective hunting for Wasm-driven exploitation attempts.
Monitor web proxy logs for repeated delivery of .wasm payloads paired with obfuscated JavaScript from untrusted origins.
Track memory-integrity and exploit-mitigation events on user endpoints for the browser and mail client processes.

How to Mitigate CVE-2026-74936

Immediate Actions Required

Upgrade Firefox to version 154 or later, and Firefox ESR to 140.14 or 153.1.
Upgrade Thunderbird to version 154, 140.14, or 153.1.
Enforce updates through enterprise management (Group Policy, MDM, or Mozilla policy JSON) rather than relying on user-initiated upgrades.
Restart browser and mail client processes after patching to ensure the vulnerable code is unloaded from memory.

Patch Information

Mozilla has released fixed builds documented in the Mozilla Security Advisory MFSA-2026-74, MFSA-2026-76, MFSA-2026-77, MFSA-2026-78, MFSA-2026-79, and MFSA-2026-80. Apply the corresponding build for each channel deployed in the environment.

Workarounds

Disable JavaScript execution on untrusted origins using content-blocking extensions or enterprise policies where feasible.
Set javascript.options.wasm to false in about:config or via enterprise policy to disable WebAssembly until patches are deployed; note that this may break legitimate applications.
In Thunderbird, disable remote content in messages and restrict HTML rendering to plain text for high-risk users.

bash

# Example Mozilla enterprise policy to disable WebAssembly as a temporary workaround
# Place in /etc/firefox/policies/policies.json (Linux) or the platform equivalent
{
  "policies": {
    "Preferences": {
      "javascript.options.wasm": {
        "Value": false,
        "Status": "locked"
      }
    }
  }
}