CVE-2026-74943: Mozilla Firefox Use-After-Free Vulnerability

CVE-2026-74943 Overview

CVE-2026-74943 is a use-after-free vulnerability [CWE-416] in the Graphics: ImageLib component of Mozilla Firefox and Thunderbird. The flaw allows an attacker to trigger memory corruption when the browser processes crafted image content, potentially leading to arbitrary code execution within the renderer process. Mozilla resolved the issue in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Critical Impact
A remote attacker can achieve arbitrary code execution by luring a user to view a malicious image or webpage, with no authentication or user interaction required beyond loading content.

Affected Products

Mozilla Firefox (versions prior to 154)
Mozilla Firefox ESR (versions prior to 115.39, 140.14, and 153.1)
Mozilla Thunderbird (versions prior to 154, 140.14, and 153.1)

Discovery Timeline

2026-08-18 - CVE-2026-74943 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-74943

Vulnerability Analysis

The vulnerability resides in ImageLib, the shared image decoding subsystem used by Gecko-based products. A use-after-free condition occurs when the component continues to reference a heap object after it has been released. An attacker can influence allocation and deallocation ordering during image decoding, resulting in a dangling pointer being dereferenced by later code paths.

Because ImageLib is invoked automatically whenever the browser or email client renders image content, exploitation does not require the victim to interact with the image directly. Loading a webpage or opening an HTML email that embeds a crafted image is sufficient to reach the vulnerable code.

Root Cause

The root cause is improper object lifetime management within the Graphics: ImageLib component. A heap object is freed while other references to it remain active. Subsequent use of the freed memory can be manipulated to overlap with attacker-controlled data, corrupting program state and enabling control-flow hijack.

Attack Vector

The attack vector is network-based. An attacker hosts a malicious page containing a crafted image, or delivers such an image in an HTML email rendered by Thunderbird. When Firefox or Thunderbird decodes the image through ImageLib, the use-after-free is triggered inside the content process, typically leading to memory corruption suitable for arbitrary code execution.

No verified public proof-of-concept is available. Refer to the Mozilla Bug Report #2057308 and the Mozilla Security Advisory MFSA-2026-74 for technical details.

Detection Methods for CVE-2026-74943

Indicators of Compromise

Unexpected crashes of firefox.exe, thunderbird.exe, or the associated content processes referencing modules such as xul.dll or ImageLib symbols.
Content processes spawning shells (cmd.exe, powershell.exe, /bin/sh) or writing executables to disk shortly after image rendering.
Outbound connections to newly observed domains initiated by browser child processes after loading web or email content.

Detection Strategies

Deploy behavioral endpoint detection to flag anomalous child processes and memory-write patterns originating from Firefox or Thunderbird.
Correlate browser crash telemetry with subsequent process creation or persistence events on the same host.
Monitor email gateways and web proxies for image files delivered from low-reputation sources targeting user endpoints.

Monitoring Recommendations

Ingest browser and Thunderbird crash reports into your SIEM and alert on ImageLib-related stack frames.
Track installed Firefox and Thunderbird versions across the fleet and flag hosts running versions below the fixed releases.
Baseline normal network egress for browser processes and alert on deviations following content rendering.

How to Mitigate CVE-2026-74943

Immediate Actions Required

Upgrade Firefox to version 154 or the relevant ESR release (115.39, 140.14, or 153.1) immediately.
Upgrade Thunderbird to version 154, 140.14, or 153.1 across all user endpoints and mail servers where applicable.
Enforce automatic updates for Mozilla products via enterprise policy to reduce exposure windows on future advisories.

Patch Information

Mozilla has published fixes in the referenced advisories: MFSA-2026-74, MFSA-2026-75, MFSA-2026-76, MFSA-2026-77, MFSA-2026-78, MFSA-2026-79, and MFSA-2026-80. Apply the update matching your channel: Firefox 154, Firefox ESR 115.39/140.14/153.1, or Thunderbird 154/140.14/153.1.

Workarounds

Configure Thunderbird to display messages as plain text to suppress automatic image decoding in email content.
Restrict browsing to trusted sites through web proxy or DNS filtering until patches are deployed enterprise-wide.
Disable remote image loading in Thunderbird via mail.inline_attachments and related preferences where operationally acceptable.

bash

# Verify installed Firefox version on Linux endpoints
firefox --version

# Verify installed Thunderbird version
thunderbird --version

# Example enterprise policy (policies.json) to enforce automatic updates
# Place at /etc/firefox/policies/policies.json or the equivalent path on Windows/macOS
{
  "policies": {
    "DisableAppUpdate": false,
    "AppAutoUpdate": true
  }
}