CVE-2026-74958: Mozilla Firefox Information Disclosure Flaw

CVE-2026-74958 Overview

CVE-2026-74958 is an information disclosure vulnerability affecting the WebRTC component in Mozilla Firefox and Mozilla Thunderbird. The flaw allows a remote attacker to access sensitive information exposed through the Web Real-Time Communication (WebRTC) subsystem without requiring authentication or user interaction. Mozilla addressed the issue in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. The vulnerability is categorized under [CWE-1021] (Improper Restriction of Rendered UI Layers or Frames) and is reachable over the network through malicious web content.

Critical Impact
Remote attackers can extract confidential data from Firefox and Thunderbird users through crafted web content that exploits the WebRTC component without any user interaction.

Affected Products

Mozilla Firefox (versions prior to 154)
Mozilla Firefox ESR (versions prior to 153.1)
Mozilla Thunderbird (versions prior to 154 and 153.1)

Discovery Timeline

2026-08-18 - CVE-2026-74958 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-74958

Vulnerability Analysis

The vulnerability resides in the WebRTC component, which handles real-time audio, video, and data communication in Firefox and Thunderbird. WebRTC exposes browser and device-level information to negotiate peer-to-peer connections, and improper isolation or restriction within this component allows attackers to observe data that should remain confidential.

An attacker delivers malicious web content that triggers the vulnerable WebRTC code path. Because the flaw is exploitable over the network with no privileges or user interaction, simply loading an attacker-controlled page is sufficient to trigger disclosure. Thunderbird is affected because it shares the same underlying rendering and media stack as Firefox.

Root Cause

Mozilla's advisories associate the issue with [CWE-1021], which covers improper restriction of rendered UI layers or frames. In the WebRTC context, this points to insufficient enforcement of origin or frame boundaries when handling media or signaling data, allowing content in one context to observe data from another.

Attack Vector

Exploitation occurs over the network. The attacker hosts crafted content that invokes WebRTC APIs in a way that leaks information across security boundaries. No authentication, elevated privileges, or user interaction beyond visiting the page is required. Full technical details are tracked in Mozilla Bug Report #2045368 and the Mozilla Security Advisory MFSA-2026-74.

Detection Methods for CVE-2026-74958

Indicators of Compromise

Firefox or Thunderbird clients running versions below 154 or ESR 153.1 initiating unexpected WebRTC sessions to unknown external endpoints.
Outbound STUN, TURN, or DTLS-SRTP traffic from user endpoints to domains with no legitimate collaboration use case.
Web page loads that immediately create RTCPeerConnection objects without corresponding user-initiated calls.

Detection Strategies

Inventory browser and mail client versions across the fleet and flag hosts still running vulnerable Firefox or Thunderbird builds.
Correlate web proxy logs with endpoint telemetry to identify visits to pages that trigger WebRTC APIs from newly seen domains.
Alert on anomalous ICE candidate gathering or peer connection creation patterns observed in browser telemetry.

Monitoring Recommendations

Track Mozilla security advisory feeds (MFSA-2026-74, MFSA-2026-77, MFSA-2026-78, MFSA-2026-80) for related follow-up fixes.
Monitor DNS and TLS SNI logs for connections to attacker infrastructure hosting exploit content.
Review endpoint process telemetry for firefox.exe and thunderbird.exe child processes spawning unexpected network activity.

How to Mitigate CVE-2026-74958

Immediate Actions Required

Upgrade all Firefox installations to version 154 or later and Firefox ESR to 153.1 or later.
Upgrade Thunderbird installations to version 154 or the 153.1 ESR release.
Prioritize patching for users who browse untrusted content or work with sensitive data.

Patch Information

Mozilla released fixes in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. Refer to the Mozilla Security Advisory MFSA-2026-74, MFSA-2026-77, MFSA-2026-78, and MFSA-2026-80 for release notes and download links.

Workarounds

Disable WebRTC in Firefox by setting media.peerconnection.enabled to false in about:config where video conferencing is not required.
Restrict access to untrusted websites through DNS filtering or web proxy policies until patches are applied.
Use enterprise policy templates to enforce automatic updates for Firefox and Thunderbird across managed endpoints.

bash

# Configuration example: disable WebRTC as a temporary workaround
# Add to Firefox policies.json or user.js
user_pref("media.peerconnection.enabled", false);