CVE-2026-74959: Firefox Storage Cache API Privilege Escalation

CVE-2026-74959 Overview

CVE-2026-74959 is a mitigation bypass vulnerability in the Storage: Cache API component of Mozilla Firefox and Thunderbird. The flaw allows a remote attacker to circumvent security protections designed to isolate cached web content. Mozilla has classified the issue as a critical-severity defect and shipped fixes across multiple release channels.

The weakness is categorized as [CWE-693] Protection Mechanism Failure. Exploitation requires no authentication, no user interaction, and can be triggered over the network by rendering malicious web content.

Critical Impact
A network-based attacker can bypass Cache API security mitigations to compromise the confidentiality and integrity of cached data across origin boundaries.

Affected Products

Mozilla Firefox versions prior to 154
Mozilla Firefox ESR versions prior to 140.14 and prior to 153.1
Mozilla Thunderbird versions prior to 154, 140.14, and 153.1

Discovery Timeline

2026-08-18 - CVE-2026-74959 published to the National Vulnerability Database
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-74959

Vulnerability Analysis

The vulnerability resides in the Storage: Cache API, a browser-exposed interface that allows web applications to persistently store request and response pairs. The Cache API is a core building block for Service Workers and Progressive Web Applications. Mozilla's advisory identifies the defect as a mitigation bypass, meaning a security control that was expected to constrain access to cached resources fails to enforce its boundary.

An attacker who serves malicious content can leverage this failure to reach cached data or state that should be inaccessible from the attacker's context. Because the attack proceeds through normal web navigation, existing browser sandboxing and same-origin protections that depend on this mitigation may not intervene.

Mozilla shipped remediation across Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. Additional context is available in Mozilla Bug #2047853 and Mozilla Security Advisory MFSA-2026-74.

Root Cause

The root cause is a protection mechanism failure [CWE-693] within the Cache API implementation. The mitigation intended to enforce isolation between origins or contexts does not correctly gate access to cached entries, allowing an attacker-controlled page to reach protected state.

Attack Vector

The attack vector is network-based. An attacker hosts a crafted page or serves malicious script that exercises the Cache API in a way the mitigation fails to block. When a victim's Firefox or Thunderbird client processes the content, the bypass triggers without user interaction beyond loading attacker-controlled resources.

No verified exploit code is publicly available. See MFSA-2026-74 through MFSA-2026-80 for vendor technical details.

Detection Methods for CVE-2026-74959

Indicators of Compromise

Firefox or Thunderbird processes on endpoints reporting versions below the patched builds (Firefox 154, ESR 140.14, ESR 153.1; Thunderbird 154, 140.14, 153.1).
Unexpected Service Worker registrations or Cache API storage growth on user profiles that did not originate from sanctioned web applications.
Outbound connections from browser processes to newly registered or low-reputation domains immediately preceding cache anomalies.

Detection Strategies

Inventory installed Firefox and Thunderbird versions through endpoint telemetry and flag hosts below the patched builds.
Correlate browser child-process activity with URL and DNS telemetry to identify sessions that load untrusted content and subsequently exhibit anomalous storage writes.
Hunt for Service Worker script fetches from uncommon domains, as Service Workers are the primary consumer of the Cache API.

Monitoring Recommendations

Ingest browser and DNS logs into a centralized data lake to enable retrospective search once additional indicators become available.
Monitor Mozilla's advisories page for revisions to MFSA-2026-74 through MFSA-2026-80 that may add exploitation indicators.
Track EPSS movement for CVE-2026-74959 to prioritize response as the community learns more about exploitability.

How to Mitigate CVE-2026-74959

Immediate Actions Required

Upgrade Firefox to version 154 or later, and Firefox ESR to 140.14 or 153.1 across all managed endpoints.
Upgrade Thunderbird to version 154, 140.14, or 153.1 depending on your deployed release track.
Force-restart browser and mail client processes after deployment so the patched binaries are actually loaded.
Validate patch coverage with software inventory data and re-scan hosts that failed to update automatically.

Patch Information

Mozilla addressed CVE-2026-74959 in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. Consult MFSA-2026-74, MFSA-2026-76, MFSA-2026-77, MFSA-2026-78, MFSA-2026-79, and MFSA-2026-80 for the advisory that matches your channel.

Workarounds

No vendor-supplied workaround exists; patching is the required remediation path.
Where immediate patching is not feasible, restrict browsing to trusted sites via enterprise policy and disable Service Workers through managed configuration.
Enforce web filtering and DNS controls to reduce exposure to attacker-controlled pages while updates roll out.

bash

# Verify installed Firefox version on Linux endpoints
firefox --version

# Verify installed Thunderbird version
thunderbird --version

# Example enterprise policy (policies.json) to disable Service Workers
# until patching is complete
{
  "policies": {
    "Preferences": {
      "dom.serviceWorkers.enabled": {
        "Value": false,
        "Status": "locked"
      }
    }
  }
}