CVE-2026-74979 Overview
CVE-2026-74979 is a mitigation bypass vulnerability in the Add-ons Manager component of Mozilla Firefox and Thunderbird. The flaw allows attackers to circumvent security controls that govern add-on installation and execution. Mozilla addressed the issue in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. The vulnerability is categorized under CWE-284: Improper Access Control and is exploitable over the network without authentication or user interaction.
Critical Impact
A remote attacker can bypass Add-ons Manager protections in unpatched Firefox and Thunderbird builds, potentially compromising confidentiality, integrity, and availability of the affected client.
Affected Products
- Mozilla Firefox versions prior to 154
- Mozilla Firefox ESR versions prior to 153.1
- Mozilla Thunderbird versions prior to 154 and ESR versions prior to 153.1
Discovery Timeline
- 2026-08-18 - CVE-2026-74979 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-74979
Vulnerability Analysis
The Add-ons Manager in Firefox and Thunderbird enforces trust boundaries around extension installation, permissions, and update flows. CVE-2026-74979 breaks one of those boundaries, letting an attacker-controlled input path bypass a mitigation that would normally block unsafe add-on behavior. Because Firefox and Thunderbird render remote web content and email content by default, an attacker can reach the vulnerable code path through a crafted page or message without any credentials.
An attacker who chains this bypass with an add-on delivery or manipulation primitive can undermine the isolation between untrusted content and privileged extension code. That combination is what drives the high impact ratings across confidentiality, integrity, and availability in the CVSS vector.
Root Cause
The root cause is improper access control (CWE-284) inside the Add-ons Manager. A security check intended to prevent an untrusted context from influencing add-on state can be bypassed, so a mitigation designed for defense-in-depth no longer holds. Mozilla has not published low-level technical details; refer to the Mozilla Bug Report #2045676 once access restrictions are lifted.
Attack Vector
Exploitation is network-based and does not require privileges or user interaction. A victim who loads attacker-controlled web content in Firefox, or opens crafted HTML content in Thunderbird, may trigger the vulnerable code path. See the vendor advisories for full context: MFSA-2026-74, MFSA-2026-77, MFSA-2026-78, and MFSA-2026-80.
No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported at the time of publication.
Detection Methods for CVE-2026-74979
Indicators of Compromise
- Firefox or Thunderbird processes spawning unexpected child processes or writing to extension directories outside of normal update flows.
- Unexplained entries in the extensions.json or addons.json profile files, or new XPI files appearing in user profile extensions directories.
- Outbound connections from firefox.exe or thunderbird.exe to domains not associated with Mozilla update or telemetry endpoints.
Detection Strategies
- Inventory Firefox and Thunderbird versions across the fleet and flag any hosts running versions earlier than Firefox 154, Firefox ESR 153.1, Thunderbird 154, or Thunderbird 153.1.
- Alert on modifications to browser and mail client extension directories that occur outside of documented update windows or software deployment jobs.
- Correlate browser process behavior with subsequent script execution, credential access, or persistence activity in EDR telemetry.
Monitoring Recommendations
- Ingest endpoint process, file, and network telemetry into a central data lake and retain long enough to investigate delayed follow-on activity.
- Track add-on install and update events from managed browser configurations where centralized policy is deployed.
- Monitor egress traffic from user endpoints for connections to unfamiliar add-on hosting or update infrastructure.
How to Mitigate CVE-2026-74979
Immediate Actions Required
- Upgrade Firefox to version 154 or later, and Firefox ESR to 153.1 or later, on all managed endpoints.
- Upgrade Thunderbird to version 154 or later, and Thunderbird ESR to 153.1 or later, across mail clients.
- Audit installed extensions in both applications and remove any that are unapproved or unrecognized.
Patch Information
Mozilla fixed CVE-2026-74979 in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. Full remediation details are documented in the Mozilla Foundation Security Advisories: MFSA-2026-74, MFSA-2026-77, MFSA-2026-78, and MFSA-2026-80. Deploy the patched builds through your standard software distribution channel and verify installed versions after rollout.
Workarounds
- No vendor-supplied workaround exists; patching is the only supported remediation.
- Restrict add-on installation using enterprise policy, for example by setting ExtensionSettings and InstallAddonsPermission in the Firefox policies.json to limit installs to a vetted allowlist until patches are fully deployed.
- Reduce exposure by disabling remote HTML rendering in Thunderbird and blocking access to untrusted web content from high-risk user groups during the patch window.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
