CVE-2026-74960 Overview
CVE-2026-74960 is a site isolation flaw in the WebExtensions component of Mozilla Firefox and Thunderbird. The vulnerability allows an attacker to bypass boundaries that separate web origins from extension contexts. Successful exploitation requires user interaction, such as visiting a malicious page or interacting with attacker-controlled content.
Mozilla addressed the issue in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. The weakness is classified under CWE-284: Improper Access Control.
Critical Impact
Network-reachable attackers can compromise confidentiality and integrity of browser data by bypassing site isolation in the WebExtensions component when a user interacts with malicious content.
Affected Products
- Mozilla Firefox versions prior to 154
- Mozilla Firefox ESR versions prior to 140.14 and 153.1
- Mozilla Thunderbird versions prior to 154, 140.14, and 153.1
Discovery Timeline
- 2026-08-18 - CVE-2026-74960 published to NVD
- 2026-08-21 - Last updated in NVD database
Technical Details for CVE-2026-74960
Vulnerability Analysis
The vulnerability resides in the WebExtensions component, which brokers privileged APIs and data access for browser add-ons. Site isolation is the security boundary that keeps content from different origins in separate processes and memory spaces. A flaw in that boundary allows content or extension code to reach data it should not access.
Because the WebExtensions layer bridges web content with elevated extension capabilities, a site isolation gap in this component enables cross-origin information exposure and manipulation. The attack requires user interaction, which aligns with drive-by scenarios where a user opens a crafted page or triggers extension-mediated behavior.
Root Cause
The root cause is improper access control within the WebExtensions component, tracked as CWE-284. Site isolation invariants intended to segregate origins and extension contexts were not consistently enforced, allowing an attacker to cross that boundary from a network-delivered payload.
Attack Vector
An attacker hosts a malicious web resource and lures a user into loading or interacting with it. The WebExtensions boundary flaw then allows the attacker to read or modify data belonging to another site or extension context. No authentication is required, but the user must perform an action such as clicking a link or navigating to the attacker's page.
No verified proof-of-concept code is available. For technical details, refer to the Mozilla Bug Report #2049148 and the Mozilla Foundation Security Advisory MFSA-2026-74.
Detection Methods for CVE-2026-74960
Indicators of Compromise
- Firefox or Thunderbird processes at versions prior to the fixed releases (Firefox 154, Firefox ESR 140.14/153.1, Thunderbird 154/140.14/153.1) running on managed endpoints.
- Unexpected WebExtensions activity such as unknown add-ons, sudden permission changes, or extension processes accessing origins outside their declared host permissions.
- Outbound connections from browser processes to newly registered or low-reputation domains shortly after user interaction with an untrusted link.
Detection Strategies
- Inventory installed browser and mail client versions across the fleet and flag hosts running vulnerable Firefox or Thunderbird builds.
- Monitor endpoint telemetry for browser child processes spawning unusual children, writing to extension storage paths, or exfiltrating cookies and session data.
- Correlate proxy and DNS logs with browser process telemetry to surface user navigation to attacker-controlled sites followed by anomalous browser behavior.
Monitoring Recommendations
- Enable software inventory reporting on endpoints to continuously track Firefox and Thunderbird versions against the fixed release list.
- Alert on installation of unsigned or sideloaded WebExtensions and on changes to extensions.json and extension permission grants.
- Review browser crash and error telemetry for repeated failures originating in the WebExtensions component, which can indicate exploitation attempts.
How to Mitigate CVE-2026-74960
Immediate Actions Required
- Upgrade Firefox to version 154 or later, and Firefox ESR to 140.14 or 153.1 or later, across all managed endpoints.
- Upgrade Thunderbird to 154, 140.14, or 153.1 or later on all systems where the mail client is deployed.
- Audit installed WebExtensions and remove any add-ons that are unknown, unsigned, or no longer required.
- Enforce enterprise browser policies that restrict extension installation to an allow-listed set from trusted publishers.
Patch Information
Mozilla shipped the fix in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. Details are available in the Mozilla Security Advisory MFSA-2026-74, MFSA-2026-76, MFSA-2026-77, MFSA-2026-78, MFSA-2026-79, and MFSA-2026-80.
Workarounds
- Disable or remove non-essential WebExtensions until all endpoints have been updated to a patched build.
- Apply enterprise policy to block installation of new extensions and to restrict the extension update URL to signed Mozilla sources.
- Use network controls such as web filtering and DNS reputation to reduce user exposure to malicious sites that could trigger the flaw.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
