CVE-2026-74990: Mozilla Firefox Buffer Overflow Vulnerability

CVE-2026-74990 Overview

CVE-2026-74990 covers a set of internally discovered bugs in Mozilla Thunderbird ESR 140.13, Thunderbird ESR 153.0, and Thunderbird 153. Several of these defects exhibited evidence of memory corruption or other security-relevant behavior. Mozilla assessed that with sufficient effort some of these bugs could have been exploited to compromise affected clients. The issues also affect corresponding Firefox codebases sharing the same underlying components. Mozilla fixed the vulnerabilities across Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Critical Impact
Network-reachable memory corruption in Firefox and Thunderbird that may allow arbitrary code execution when a user renders attacker-controlled content.

Affected Products

Mozilla Firefox (prior to 154, ESR 115.39, ESR 140.14, ESR 153.1)
Mozilla Thunderbird 153 and Thunderbird ESR 153.0 (prior to 153.1)
Mozilla Thunderbird ESR 140.13 (prior to 140.14)

Discovery Timeline

2026-08-18 - CVE-2026-74990 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-74990

Vulnerability Analysis

The advisory groups multiple internally discovered defects under a single identifier tied to CWE-119, improper restriction of operations within the bounds of a memory buffer. Mozilla states that some of the reported bugs showed evidence of memory corruption or other security-relevant defects. Because Firefox and Thunderbird share the Gecko rendering and JavaScript engine components, a bug reachable through web content in Firefox is often reachable through HTML email or remote content in Thunderbird.

The attack surface spans HTML parsing, layout, graphics, and JavaScript execution paths. An attacker able to deliver crafted web pages or email content can trigger the flawed code paths without requiring authentication or user interaction beyond normal browsing or message rendering.

Root Cause

The root cause is memory-safety weaknesses classified under CWE-119. These defects allow read or write operations that extend beyond the bounds of intended buffers within the browser engine. Mozilla did not publish per-bug root-cause detail for this rollup advisory, referring instead to individual Bugzilla entries.

Attack Vector

Exploitation occurs over the network with no privileges and no user interaction beyond loading attacker-controlled content. In Firefox, the delivery vector is a malicious or compromised web page. In Thunderbird, the vector includes HTML email content and any remote resources the client loads during message rendering. Successful exploitation of a memory-corruption primitive in this class of bug can lead to arbitrary code execution in the context of the browser or mail client process.

No verified public proof-of-concept code has been released. See the Mozilla Bugzilla report list for individual bug details.

Detection Methods for CVE-2026-74990

Indicators of Compromise

Unexpected child processes spawned by firefox.exe or thunderbird.exe, particularly command shells or scripting hosts.
Crashes or repeated restarts of the browser or mail client following the rendering of specific content.
Outbound network connections initiated from browser or mail client processes to unfamiliar hosts shortly after content rendering.

Detection Strategies

Inventory endpoint versions of Firefox and Thunderbird and flag installations below the fixed builds (Firefox 154, Firefox ESR 115.39/140.14/153.1, Thunderbird 154/140.14/153.1).
Monitor process-lineage telemetry for Mozilla applications spawning cmd.exe, powershell.exe, wscript.exe, or writing executable payloads to disk.
Correlate mail-gateway logs with endpoint alerts to identify HTML email that triggers client crashes.

Monitoring Recommendations

Enable crash reporting and centralize crash telemetry from Firefox and Thunderbird to identify targeted exploitation attempts.
Ingest endpoint process and network telemetry into a SIEM or data lake to support retrospective hunting against the affected versions.
Track Mozilla security advisories MFSA-2026-74 through MFSA-2026-80 for related fixes and follow-on regressions.

How to Mitigate CVE-2026-74990

Immediate Actions Required

Upgrade Firefox installations to version 154, or to ESR 115.39, ESR 140.14, or ESR 153.1 as appropriate for your channel.
Upgrade Thunderbird installations to version 154, 140.14, or 153.1.
Enforce automatic updates through enterprise policy so that clients receive future Mozilla security releases without user action.

Patch Information

Mozilla addressed the issues in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. Refer to the Mozilla Security Advisory MFSA-2026-74 and related advisories through MFSA-2026-80 for per-product fix details.

Workarounds

In Thunderbird, disable HTML message rendering and remote content loading until clients are patched.
Restrict browser use to trusted sites through web proxy or DNS filtering where full patching cannot be completed immediately.
Apply application allowlisting to block unexpected child processes from Firefox and Thunderbird.

bash

# Verify installed versions on Linux endpoints
firefox --version
thunderbird --version

# Example: enforce automatic updates via Firefox enterprise policy (policies.json)
# /etc/firefox/policies/policies.json
# {
#   "policies": {
#     "DisableAppUpdate": false,
#     "AppAutoUpdate": true
#   }
# }