CVE-2026-74987: Mozilla Firefox Buffer Overflow Vulnerability

CVE-2026-74987 Overview

CVE-2026-74987 tracks a set of internally discovered memory safety bugs affecting Mozilla Firefox and Thunderbird. Mozilla engineers found the defects across Thunderbird ESR 140.13, Thunderbird ESR 153.0, and Thunderbird 153, with matching code paths present in Firefox. Several of the bugs showed evidence of memory corruption, and Mozilla assessed that with sufficient effort some could have been exploited to run arbitrary code. The issue is classified under [CWE-119] (improper restriction of operations within the bounds of a memory buffer).

Critical Impact
A network-reachable attacker can trigger memory corruption in the browser or mail client, potentially leading to arbitrary code execution in the affected process without user interaction.

Affected Products

Mozilla Firefox prior to 154, Firefox ESR prior to 140.14, and Firefox ESR prior to 153.1
Mozilla Thunderbird prior to 154, Thunderbird ESR prior to 140.14, and Thunderbird ESR prior to 153.1
Thunderbird 153 and Thunderbird ESR 140.13 / 153.0 baseline builds

Discovery Timeline

2026-08-18 - CVE-2026-74987 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-74987

Vulnerability Analysis

CVE-2026-74987 aggregates multiple memory safety defects identified by Mozilla developers during internal testing of Firefox and Thunderbird. The affected code spans the shared Gecko platform used by both products, so rendering, parsing, and content-handling paths reachable from web content or email content are in scope. Mozilla stated that some of the bugs exhibited evidence of memory corruption, indicating out-of-bounds access, use-after-free, or similar unsafe operations on heap or stack buffers.

Because Thunderbird renders HTML email through the same engine as Firefox, an attacker can deliver a crafted message that exercises the vulnerable code when the message is displayed or previewed. In Firefox, a malicious page can reach the defect through normal web navigation.

Root Cause

The root cause is improper restriction of operations within memory buffers, consistent with [CWE-119]. Mozilla did not disclose per-bug specifics for each entry in the referenced Bugzilla lists, but the aggregate advisory characterizes the defects as memory corruption in engine components shared across Firefox and Thunderbird. Full technical detail is tracked in the linked Mozilla Bugzilla entries.

Attack Vector

Exploitation is network-based and requires no privileges or user interaction beyond loading attacker-controlled content. For Firefox, visiting a crafted page is sufficient. For Thunderbird, viewing a crafted HTML email in the message pane can reach the same code paths. Successful exploitation would yield code execution in the content or parent process, subject to Mozilla's sandbox constraints. See the Mozilla Security Advisory MFSA-2026-74 for the vendor summary.

Detection Methods for CVE-2026-74987

Indicators of Compromise

Firefox or Thunderbird processes crashing with access violations, heap corruption, or ASan-style faults immediately after rendering web content or HTML email.
Child content processes (firefox.exe, thunderbird.exe, plugin-container) spawning unexpected shells, powershell.exe, cmd.exe, or writing executables to user-writable paths.
Outbound connections from browser or mail client processes to newly registered or low-reputation domains following delivery of an HTML email.

Detection Strategies

Inventory endpoints for vulnerable Firefox and Thunderbird builds using software asset data and flag versions below Firefox 154, Firefox ESR 140.14/153.1, or Thunderbird 154/140.14/153.1.
Alert on browser or mail client child processes performing LOLBin execution, credential access, or persistence writes, which are typical post-exploitation behaviors for browser memory corruption.
Correlate email delivery events with subsequent process anomalies on the recipient host to identify Thunderbird-borne exploitation.

Monitoring Recommendations

Ingest EDR process telemetry and email gateway logs into a centralized data lake so browser process lineage can be joined with message metadata.
Monitor crash telemetry (Windows Error Reporting, macOS crash reports, core files on Linux) for repeated faults in Gecko-based binaries.
Track egress from browser and mail client processes to detect command-and-control activity following successful exploitation.

How to Mitigate CVE-2026-74987

Immediate Actions Required

Upgrade Firefox to 154, Firefox ESR to 140.14 or 153.1, and Thunderbird to 154, 140.14, or 153.1 as applicable to your deployment channel.
Prioritize patching hosts that browse untrusted content or receive external email, including executives and help-desk staff.
Restart Firefox and Thunderbird after installation so the patched binaries are loaded into memory.

Patch Information

Mozilla fixed the underlying bugs in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. Refer to MFSA-2026-74, MFSA-2026-76, MFSA-2026-77, MFSA-2026-78, MFSA-2026-79, and MFSA-2026-80 for the release notes tied to each channel.

Workarounds

Disable HTML rendering in Thunderbird and view messages as plain text to reduce exposure of the rendering engine to attacker-controlled markup.
Deploy enterprise policies that restrict Firefox and Thunderbird from executing child processes or writing to sensitive locations until patches are applied.
Route inbound email through a gateway that strips active content and detonates suspicious HTML attachments in a sandbox.

bash

# Verify installed versions on Linux endpoints
firefox --version
thunderbird --version

# Force policy-based updates on Windows via configuration profile
# Set the following registry values so managed clients pull the fixed builds
# HKLM\SOFTWARE\Policies\Mozilla\Firefox\DisableAppUpdate = 0
# HKLM\SOFTWARE\Policies\Mozilla\Thunderbird\DisableAppUpdate = 0