CVE-2026-74957: Firefox Safe Browsing Privilege Escalation

CVE-2026-74957 Overview

CVE-2026-74957 is a mitigation bypass vulnerability in the Safe Browsing component of Mozilla Firefox and Thunderbird. Safe Browsing is the protection layer that warns users about phishing, malware, and other dangerous web content. The flaw allows a network-based attacker to bypass a security mitigation when a user interacts with attacker-controlled content. Mozilla addressed the issue in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. The weakness is categorized under CWE-693: Protection Mechanism Failure.

Critical Impact
A successful bypass allows attackers to circumvent Safe Browsing protections, exposing users to malicious sites and content that would normally be blocked, with high impact to confidentiality and integrity.

Affected Products

Mozilla Firefox versions prior to 154 (including Firefox ESR before 140.14 and 153.1)
Mozilla Thunderbird versions prior to 154 (including Thunderbird 140.14 and 153.1)
Downstream distributions bundling the affected Gecko-based browser and mail components

Discovery Timeline

2026-08-18 - CVE-2026-74957 published to the National Vulnerability Database
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-74957

Vulnerability Analysis

The vulnerability resides in the Safe Browsing component, which is responsible for checking URLs and downloaded content against Mozilla's threat lists. A flaw in the protection logic allows an attacker to bypass this safety check under specific conditions. Because Safe Browsing acts as a gatekeeper against known-malicious content, bypassing it removes an important layer of defense before the browser renders or downloads attacker-supplied resources.

Exploitation requires user interaction, such as clicking a crafted link or opening a message containing attacker-controlled content. The attack can be delivered remotely over the network without any prior authentication. Once the mitigation is bypassed, the attacker can serve content that would otherwise trigger a Safe Browsing warning, enabling downstream phishing, credential theft, or malware delivery.

Root Cause

Mozilla classifies the underlying defect as a Protection Mechanism Failure. In this class of bug, a security control exists and executes but fails to enforce its intended check for a specific input or code path. The Safe Browsing lookup or classification logic does not correctly evaluate certain requests, allowing them to proceed as if the resource were benign. Mozilla's advisories MFSA-2026-74 through MFSA-2026-80 document the corrective changes shipped across Firefox and Thunderbird release trains.

Attack Vector

The attack vector is network-based and requires user interaction. A typical exploitation path involves an attacker hosting a malicious page or embedding a crafted resource, then luring a target to interact with it through social engineering. Once the Safe Browsing check is bypassed, the browser proceeds to load or download the resource without warning the user.

No public proof-of-concept or in-the-wild exploitation has been reported. Technical details are available in the Mozilla Bug Report #2041906 and the corresponding Mozilla Security Advisory MFSA-2026-74.

Detection Methods for CVE-2026-74957

Indicators of Compromise

Firefox or Thunderbird clients running versions prior to 154, ESR 140.14, or ESR 153.1 loading content from known phishing or malware distribution domains without user-facing Safe Browsing warnings.
Outbound connections from browser processes to domains flagged by external threat intelligence but not blocked at the endpoint.
Downloads of executable or script content originating from URLs that later appear on Google Safe Browsing or similar reputation feeds.

Detection Strategies

Inventory endpoints for outdated Firefox and Thunderbird builds using software asset management or EDR telemetry, and flag any version below the patched releases.
Correlate browser process telemetry with proxy and DNS logs to identify traffic to newly registered or low-reputation domains that should have been blocked.
Alert on downloads of high-risk file types initiated by firefox.exe or thunderbird.exe immediately after navigation events involving redirect chains.

Monitoring Recommendations

Ingest browser and mail client version data into your SIEM or data lake to continuously track patch compliance across the fleet.
Monitor web proxy logs for URL categories associated with phishing and malware, with elevated alerting for Firefox and Thunderbird user agents on unpatched versions.
Enable endpoint behavioral rules for post-exploitation activity such as credential prompts spawned by browser child processes or unexpected script execution.

How to Mitigate CVE-2026-74957

Immediate Actions Required

Upgrade Firefox to version 154 or later, and Firefox ESR to 140.14 or 153.1 as appropriate for your deployment channel.
Upgrade Thunderbird to version 154 or later, or apply the ESR updates 140.14 or 153.1.
Push updates through enterprise management tooling such as group policy, Intune, Jamf, or configuration management systems to ensure fleet-wide coverage.
Validate that automatic updates are enabled and functional on user endpoints and terminal servers.

Patch Information

Mozilla released fixes across multiple advisories: MFSA-2026-74, MFSA-2026-76, MFSA-2026-77, MFSA-2026-78, MFSA-2026-79, and MFSA-2026-80. Administrators should apply the update track that matches their existing deployment: rapid release for Firefox 154 and Thunderbird 154, or the ESR tracks for 140.14 and 153.1.

Workarounds

Restrict browsing to trusted destinations using enterprise web filtering, DNS-layer security, or a secure web gateway until patches are deployed.
Enforce mail security controls such as URL rewriting and attachment sandboxing to compensate for reduced client-side Safe Browsing protection in Thunderbird.
Increase user awareness communications about phishing lures during the patch rollout window, and require reauthentication for sensitive applications from browser sessions.

bash

# Verify installed Firefox version on Linux/macOS endpoints
firefox --version

# Verify installed Thunderbird version
thunderbird --version

# Windows PowerShell: check installed Firefox version from the registry
Get-ItemProperty 'HKLM:\SOFTWARE\Mozilla\Mozilla Firefox' | Select-Object CurrentVersion