CVE-2026-74945: Firefox Graphics Text Information Disclosure

CVE-2026-74945 Overview

CVE-2026-74945 is an information disclosure vulnerability in the Graphics: Text component shared across Mozilla Firefox and Thunderbird. The flaw is categorized under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor). An attacker who convinces a user to load crafted web content can trigger the issue and read data the browser should keep isolated. Mozilla addressed the vulnerability in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Critical Impact
A remote attacker can leak sensitive in-process data through the Graphics: Text component when a user visits or previews crafted content, undermining browser confidentiality boundaries.

Affected Products

Mozilla Firefox before 154 and Firefox ESR before 115.39, 140.14, and 153.1
Mozilla Thunderbird before 154, 140.14, and 153.1
Any downstream distribution shipping the affected Gecko gfx/text component

Discovery Timeline

2026-08-18 - CVE-2026-74945 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-74945

Vulnerability Analysis

The vulnerability resides in the Graphics: Text component of Gecko, the rendering engine used by Firefox and Thunderbird. This subsystem handles font shaping, glyph rasterization, and text layout. A flaw in how the component processes text-related data allows sensitive memory contents to be exposed to attacker-controlled script or rendering paths.

Exploitation requires user interaction, such as visiting a malicious web page or previewing an HTML email in Thunderbird. Successful exploitation yields high confidentiality impact without affecting integrity or availability. The disclosed information can include process memory that assists in bypassing address space layout randomization or chaining with other browser vulnerabilities.

Root Cause

Mozilla classified the issue under [CWE-200], indicating that the Graphics: Text component returns or renders information derived from memory the caller should not observe. Common patterns in this class of defect include uninitialized pixel buffers, out-of-bounds reads during glyph handling, and improper isolation between content-origin data and internal state. Public references point to Mozilla Bug Report #2057808 for the tracked fix.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts crafted content, such as a page or HTML email containing specific text, fonts, or canvas operations, that triggers the flawed code path. When the victim loads the content, the Graphics: Text component leaks in-process data that attacker-controlled script can read back. No privileges are required on the target host. Additional context is available in Mozilla Security Advisory MFSA-2026-74 and the sibling advisories MFSA-2026-75 through MFSA-2026-80.

No public proof-of-concept exploit is currently listed for this CVE, and it is not tracked on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-74945

Indicators of Compromise

Endpoints running Firefox versions earlier than 154 or Firefox ESR earlier than 115.39, 140.14, or 153.1
Thunderbird clients earlier than 154, 140.14, or 153.1 rendering remote HTML content
Outbound web sessions to unfamiliar domains immediately followed by unusual browser child-process memory growth
HTML email opens that trigger font or canvas-heavy content from untrusted senders

Detection Strategies

Inventory installed browser and mail client versions and flag any host below the fixed builds listed in the Mozilla advisories.
Correlate web proxy logs with browser telemetry to identify users visiting low-reputation domains that serve custom fonts or canvas-heavy pages.
Alert on Thunderbird processes loading remote content when remote content is disabled by policy.

Monitoring Recommendations

Track Firefox and Thunderbird version distribution via endpoint management tooling and enforce automated updates.
Monitor for exploitation follow-on activity such as sandbox escapes, unexpected child processes from firefox.exe or thunderbird.exe, and outbound connections to newly registered domains.
Review browser crash telemetry for repeated faults inside the Graphics: Text component, which can indicate exploitation attempts.

How to Mitigate CVE-2026-74945

Immediate Actions Required

Upgrade Firefox to version 154 or later on all managed endpoints.
Upgrade Firefox ESR deployments to 115.39, 140.14, or 153.1 depending on the branch in use.
Upgrade Thunderbird to 154, 140.14, or 153.1 and restart the application to load the patched binaries.
Prioritize systems used for high-value browsing or those that render HTML email from external senders.

Patch Information

Mozilla shipped fixes in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. Details are available in Mozilla Security Advisory MFSA-2026-74 and the associated advisories MFSA-2026-75, MFSA-2026-76, MFSA-2026-77, MFSA-2026-78, MFSA-2026-79, and MFSA-2026-80.

Workarounds

Disable automatic loading of remote content in Thunderbird by setting mailnews.message_display.disable_remote_image to true.
Restrict browsing to trusted sites via web filtering until patches are deployed across the fleet.
Enforce a content security policy or extension such as a script blocker to reduce exposure to attacker-controlled canvas and font content.

bash

# Configuration example: verify installed Firefox version on Linux endpoints
firefox --version
# Expected output on patched systems: Mozilla Firefox 154.0 or later

# Enterprise policy snippet (policies.json) to force update channel
# Place in the Firefox distribution directory
# {
#   "policies": {
#     "DisableAppUpdate": false,
#     "AppAutoUpdate": true
#   }
# }