CVE-2026-74954 Overview
CVE-2026-74954 is an information disclosure vulnerability in the Storage: Cache API component of Mozilla Firefox and Thunderbird. A side-channel weakness in the Cache API allows a remote attacker to infer sensitive data across origins without user interaction. Mozilla addressed the issue in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. The flaw maps to CWE-203: Observable Discrepancy, where behavioral differences in the Cache API leak information an attacker should not observe.
Critical Impact
A network-based attacker can exploit timing or state differences in the Cache API to disclose confidential browser data across origins.
Affected Products
- Mozilla Firefox versions prior to 154
- Mozilla Firefox ESR versions prior to 153.1
- Mozilla Thunderbird versions prior to 154 and prior to 153.1
Discovery Timeline
- 2026-08-18 - CVE-2026-74954 published to the National Vulnerability Database (NVD)
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-74954
Vulnerability Analysis
The vulnerability resides in the Storage: Cache API, a Service Worker-associated storage mechanism used by web applications to persist HTTP request and response pairs. The Cache API exposes an observable discrepancy that an attacker-controlled origin can measure. By interacting with the API and monitoring differences in behavior, the attacker infers state that should remain isolated between origins.
Because the attack is network-reachable and requires no privileges or user interaction, any site a user visits can attempt exploitation. The impact is scoped to confidentiality; integrity and availability are unaffected.
Root Cause
The root cause is a side-channel in the Cache API implementation ([CWE-203]). The component behaves in a way that lets an attacker distinguish between cache states or entries belonging to another origin. Mozilla's remediation removes or masks the discrepancy so cross-origin observations no longer reveal information.
Attack Vector
Exploitation occurs remotely through a malicious web page loaded in an unpatched Firefox or Thunderbird build. The attacker's script issues Cache API operations and measures observable differences, such as timing or response state, to reconstruct data the browser holds for other origins. No authentication is required, and the user only needs to load attacker-controlled content.
No public proof-of-concept exploit is currently listed for CVE-2026-74954. Refer to the Mozilla Bug Report #2025732 and Mozilla Foundation Security Advisories for technical context.
Detection Methods for CVE-2026-74954
Indicators of Compromise
- No file-based indicators are published for this vulnerability; browser telemetry and network artifacts are the primary detection surface.
- Repeated Cache API calls from a single origin combined with high-precision timing measurements in JavaScript may indicate probing.
- Outbound HTTPS traffic to unfamiliar domains immediately after users load unknown links.
Detection Strategies
- Inventory installed Firefox and Thunderbird versions across managed endpoints and flag builds older than Firefox 154, Firefox ESR 153.1, or Thunderbird 154/153.1.
- Correlate browser process telemetry with proxy or DNS logs to identify visits to newly registered or low-reputation domains that could host side-channel probes.
- Monitor endpoint detection tooling for anomalous child processes or persistence spawned from browser sessions on outdated builds.
Monitoring Recommendations
- Enable centralized browser update reporting through group policy or an MDM to confirm patched versions are deployed.
- Track visits to sites requesting Service Worker registrations at unusual volumes, since the Cache API is Service Worker-adjacent.
- Alert on prolonged sessions where a single tab performs high-frequency Cache API storage operations against multiple origins.
How to Mitigate CVE-2026-74954
Immediate Actions Required
- Upgrade Firefox to version 154 or later, and Firefox ESR to 153.1 or later, on all managed workstations.
- Upgrade Thunderbird to version 154 or 153.1 or later on all endpoints running the mail client.
- Force-restart browser processes after deployment to ensure the patched binaries are loaded.
Patch Information
Mozilla shipped fixes across four advisories covering Firefox and Thunderbird release trains: MFSA-2026-74, MFSA-2026-77, MFSA-2026-78, and MFSA-2026-80. Administrators should apply the vendor patch through the built-in updater, enterprise policies, or their software distribution platform.
Workarounds
- No official workaround is provided by Mozilla; patching is the supported remediation path.
- Where immediate patching is not possible, restrict browsing on affected endpoints to a curated allowlist of trusted sites.
- Disable Service Workers or Cache API access via enterprise browser policies as a temporary hardening step, understanding that this may break legitimate web applications.
# Verify installed Firefox version on Linux/macOS endpoints
firefox --version
# Windows enterprise policy snippet to enforce auto-updates
# HKLM\SOFTWARE\Policies\Mozilla\Firefox
# DisableAppUpdate = 0
# AppAutoUpdate = 1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
