CVE-2026-74973: Mozilla Firefox Race Condition Vulnerability

CVE-2026-74973 Overview

CVE-2026-74973 is a race condition leading to a use-after-free in the Graphics component of Mozilla Firefox and Thunderbird. An attacker who convinces a user to load crafted web content can trigger concurrent access to freed graphics memory. Successful exploitation may lead to memory corruption with limited confidentiality and integrity impact. Mozilla addressed the flaw in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. The weakness is classified as [CWE-362] Concurrent Execution using Shared Resource with Improper Synchronization.

Critical Impact
A race condition in the Graphics component may allow memory corruption through a use-after-free triggered by malicious web content.

Affected Products

Mozilla Firefox (versions prior to 154)
Mozilla Firefox ESR (prior to 115.39, 140.14, and 153.1)
Mozilla Thunderbird (prior to 154, 140.14, and 153.1)

Discovery Timeline

2026-08-18 - CVE-2026-74973 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-74973

Vulnerability Analysis

The vulnerability resides in the Graphics component shared by Firefox and Thunderbird. Concurrent threads can access a graphics object while another execution path frees the underlying memory. When the surviving reference is later dereferenced, the process operates on freed memory, producing a use-after-free condition.

The attack requires user interaction, typically loading crafted content in the browser or previewing an HTML email in Thunderbird. Exploitation complexity is high because the attacker must win a narrow race window between allocation, free, and reuse events. Successful exploitation results in memory corruption that may lead to limited information disclosure or integrity violations within the renderer process.

Mozilla documents the fix across advisories MFSA-2026-74 through MFSA-2026-80. See Mozilla Bug Report #2060357 for developer-side technical context.

Root Cause

The root cause is improper synchronization between threads accessing shared graphics state. One thread releases an object referenced by another thread that continues executing, violating the object's lifetime contract. This is a classic [CWE-362] race condition materializing as a use-after-free.

Attack Vector

Exploitation occurs over the network. An attacker hosts crafted web content and lures the target to open it in a vulnerable Firefox build. In Thunderbird, remote HTML content rendered in the message pane can also exercise the vulnerable code path. No authentication is required, but the user must interact with attacker-controlled content.

No public exploit or proof-of-concept has been observed at the time of publication. Refer to the Mozilla Security Advisory MFSA-2026-74 for vendor-supplied technical details.

Detection Methods for CVE-2026-74973

Indicators of Compromise

Unexpected renderer or content-process crashes referencing the Graphics subsystem on Firefox or Thunderbird hosts.
Crash reports containing use-after-free signatures in graphics-related modules such as gfx, layers, or webrender.
Browser sessions loading unfamiliar domains immediately preceding process termination or instability.

Detection Strategies

Inventory Firefox and Thunderbird versions across endpoints and flag builds below the fixed releases listed in the Mozilla advisories.
Monitor endpoint telemetry for repeated crashes of firefox.exe or thunderbird.exe that correlate with recent web navigation events.
Correlate proxy or DNS logs with crash timestamps to identify potentially malicious pages that triggered the fault.

Monitoring Recommendations

Enable and centralize Mozilla crash reporting to identify recurring graphics-component faults across the fleet.
Alert on outbound connections from browser processes to newly registered or low-reputation domains preceding a crash.
Track patch-compliance metrics for Firefox ESR and Thunderbird channels to accelerate remediation of unmanaged endpoints.

How to Mitigate CVE-2026-74973

Immediate Actions Required

Update Firefox to version 154 or the appropriate ESR release (115.39, 140.14, or 153.1).
Update Thunderbird to version 154, 140.14, or 153.1 as applicable to the deployed channel.
Prioritize patching endpoints where users regularly browse untrusted sites or open external HTML email.

Patch Information

Mozilla released fixes across seven advisories: MFSA-2026-74, MFSA-2026-75, MFSA-2026-76, MFSA-2026-77, MFSA-2026-78, MFSA-2026-79, and MFSA-2026-80. Apply the corresponding Firefox or Thunderbird update through vendor update channels or enterprise deployment tooling.

Workarounds

Restrict access to untrusted web content through network-level URL filtering until patches are deployed.
Configure Thunderbird to render messages as plain text to reduce exposure through remote HTML content.
Disable hardware acceleration in Firefox as a temporary measure to shrink the vulnerable graphics attack surface.

bash

# Configuration example: disable HTML rendering in Thunderbird via user.js
user_pref("mailnews.display.prefer_plaintext", true);
user_pref("mailnews.display.html_as", 1);
user_pref("mailnews.display.disallow_mime_handlers", 3);