CVE-2026-74972: Mozilla Firefox Information Disclosure Flaw

CVE-2026-74972 Overview

CVE-2026-74972 is an information disclosure vulnerability in the DOM Push Subscriptions component of Mozilla Firefox and Thunderbird. The flaw allows a malicious web page to leak limited confidential data from the browser when a user interacts with attacker-controlled content. Mozilla fixed the issue in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. The underlying weakness is classified as [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Remote attackers can trick users into visiting crafted pages that expose limited confidential information handled by the Push Subscriptions API in the browser DOM.

Affected Products

Mozilla Firefox prior to version 154
Mozilla Firefox ESR prior to 140.14 and prior to 153.1
Mozilla Thunderbird prior to 154, 140.14, and 153.1

Discovery Timeline

2026-08-18 - CVE-2026-74972 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-74972

Vulnerability Analysis

The vulnerability resides in the DOM Push Subscriptions component, which manages subscriptions to the Web Push protocol for receiving server-sent notifications. Improper handling within this component allows a remote origin to observe information that should remain isolated from untrusted script contexts. The issue is classified under [CWE-200], indicating exposure of sensitive information to an unauthorized actor. Exploitation requires user interaction, such as visiting a crafted web page, and does not require authentication.

Root Cause

Mozilla's advisories describe the issue as information disclosure within Push Subscriptions logic in the DOM. The component fails to sufficiently restrict access to state or metadata associated with push subscriptions, allowing script executing in a page context to read data that should be scoped to the browser or another origin. Full technical specifics remain restricted in Mozilla Bug 2059053 pending broader patch adoption.

Attack Vector

The attack is network-based and requires user interaction. An attacker hosts a page that invokes Push Subscription APIs and triggers the disclosure path. When a victim navigates to the page, the malicious script reads the leaked data and exfiltrates it to an attacker-controlled endpoint. The scope is unchanged, and only confidentiality is impacted at a limited level. No verified public proof-of-concept is available at the time of publication.

See Mozilla Security Advisory MFSA-2026-74 for vendor detail on affected builds.

Detection Methods for CVE-2026-74972

Indicators of Compromise

Endpoints running Firefox or Thunderbird at versions below 154, 140.14, or 153.1 on the ESR channels.
Browser telemetry showing repeated calls to PushManager.subscribe() or PushManager.getSubscription() originating from newly observed or low-reputation domains.
Outbound HTTP POST traffic from browser processes to uncategorized domains shortly after page loads that request notification permissions.

Detection Strategies

Inventory installed browser and mail client versions across managed endpoints and flag hosts below the fixed versions listed in the Mozilla advisories.
Monitor web proxy and DNS logs for user navigation to newly registered domains that request Notification or Push API permissions.
Correlate browser child process network activity with recent installations or updates to identify unpatched instances actively browsing untrusted content.

Monitoring Recommendations

Enable EDR telemetry on firefox.exe, thunderbird.exe, and their Linux and macOS equivalents to capture child process and network events.
Ingest browser update status into the SIEM to alert when hosts remain on vulnerable Firefox or Thunderbird builds after the patch release window.
Track push notification permission grants where feasible using browser management policies or enterprise browser telemetry.

How to Mitigate CVE-2026-74972

Immediate Actions Required

Upgrade Firefox to version 154 or later, and Firefox ESR to 140.14 or 153.1 on managed endpoints.
Upgrade Thunderbird to 154, 140.14, or 153.1 on all workstations that process untrusted HTML mail.
Push updates through enterprise deployment tooling and validate version compliance across the fleet.

Patch Information

Mozilla addressed CVE-2026-74972 in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. Refer to the vendor bulletins for build-specific guidance: MFSA-2026-74, MFSA-2026-76, MFSA-2026-77, MFSA-2026-78, MFSA-2026-79, and MFSA-2026-80.

Workarounds

Disable Web Push notifications via enterprise policy where the feature is not required for business workflows.
Restrict notification permission prompts using the Permissions policy in Firefox ESR deployments (dom.push.enabled set to false).
Block or sandbox untrusted mail content in Thunderbird by disabling remote content and JavaScript execution in message display settings.

bash

# Configuration example: disable Web Push in Firefox via policies.json
{
  "policies": {
    "Preferences": {
      "dom.push.enabled": {
        "Value": false,
        "Status": "locked"
      }
    }
  }
}