CVE-2026-74944: Mozilla Firefox Use-After-Free Vulnerability

CVE-2026-74944 Overview

CVE-2026-74944 is a use-after-free vulnerability in the DOM: Core & HTML component of Mozilla Firefox and Thunderbird. The flaw affects how the browser engine manages memory objects associated with DOM elements, allowing an attacker to reference memory after it has been freed. A remote attacker can trigger the condition through a crafted web page or HTML email content, with no privileges or user interaction beyond visiting the page.

Mozilla addressed the issue in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. The vulnerability is classified under CWE-416.

Critical Impact
Successful exploitation can result in arbitrary code execution in the context of the browser process, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

Mozilla Firefox versions prior to 154
Mozilla Firefox ESR versions prior to 140.14 and 153.1
Mozilla Thunderbird versions prior to 154, 140.14, and 153.1

Discovery Timeline

2026-08-18 - CVE-2026-74944 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-74944

Vulnerability Analysis

The vulnerability resides in the DOM: Core & HTML component of the Gecko engine. Use-after-free flaws occur when code continues to reference a memory object after the allocator has released it. In browser engines, this pattern commonly arises when JavaScript retains a reference to a DOM node whose backing C++ object has been destroyed during layout, reflow, or garbage collection cycles.

An attacker can shape the freed memory region with attacker-controlled data. When the dangling pointer is later dereferenced, the engine operates on attacker-influenced state. This chain can be leveraged to redirect control flow or corrupt object metadata.

Root Cause

The root cause is improper lifetime management of DOM objects within the Core & HTML subsystem. Mozilla's advisories group this issue with other DOM lifetime defects fixed in the same release cycle. Reference the Mozilla Bug Report 2057778 for the tracked defect.

Attack Vector

Exploitation is remote and network-based. An attacker hosts a malicious page or delivers HTML email content that triggers the vulnerable DOM manipulation path. When a victim loads the content in an unpatched Firefox or Thunderbird build, the engine reaches the freed object and the attacker gains code execution primitives within the content process.

No authentication is required. Thunderbird users are exposed when remote content or scripting is enabled in message rendering.

See the Mozilla Security Advisory MFSA-2026-74 and companion advisories MFSA-2026-76 through MFSA-2026-80 for advisory-level technical detail. No public proof-of-concept exploit is available at publication time.

Detection Methods for CVE-2026-74944

Indicators of Compromise

Unexpected Firefox or Thunderbird process crashes with signatures pointing to DOM, Core, or HTML modules in crash reporter data.
Firefox or Thunderbird child content processes spawning shells, powershell.exe, cmd.exe, or LOLBins after rendering web or email content.
Outbound network connections from browser or mail client processes to unfamiliar hosts immediately after content rendering.

Detection Strategies

Inventory installed Firefox and Thunderbird versions across the fleet and flag builds below the fixed versions listed in Mozilla's advisories.
Monitor endpoint telemetry for browser or mail-client child processes performing file writes to startup or persistence locations.
Correlate crash telemetry with web proxy logs to identify users who visited a common URL prior to a browser crash cluster.

Monitoring Recommendations

Ingest browser crash dumps and endpoint process telemetry into a central analytics platform for behavioral correlation.
Alert on anomalous parent-child process relationships originating from firefox.exe or thunderbird.exe.
Track outbound connections from browser processes to newly registered or low-reputation domains.

How to Mitigate CVE-2026-74944

Immediate Actions Required

Upgrade Firefox to version 154 or later, and Firefox ESR to 140.14 or 153.1 across all managed endpoints.
Upgrade Thunderbird to 154, 140.14, or 153.1 depending on the deployed release channel.
Prioritize systems used for high-risk browsing, administrative access, or handling of untrusted email attachments.

Patch Information

Mozilla released fixes in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. Refer to the Mozilla Security Advisory MFSA-2026-74, MFSA-2026-76, MFSA-2026-77, MFSA-2026-78, MFSA-2026-79, and MFSA-2026-80 for release-specific details.

Workarounds

Disable JavaScript on untrusted sites using site permissions or an enterprise policy where operationally feasible.
Configure Thunderbird to block remote content and disable JavaScript in message display until patches are deployed.
Restrict browser use for privileged administrative accounts to trusted, patched systems only.

bash

# Firefox enterprise policy example: force automatic updates
# policies.json placed in the Firefox distribution directory
{
  "policies": {
    "DisableAppUpdate": false,
    "AppAutoUpdate": true,
    "JavascriptOnUntrustedSites": "block"
  }
}