CVE-2026-75874: Mozilla Firefox Sandbox Escape Vulnerability

CVE-2026-75874 Overview

CVE-2026-75874 is a sandbox escape vulnerability in the Remote Settings Client component of Mozilla Firefox and Thunderbird. The flaw affects the browser's protection mechanism [CWE-693], allowing attackers to break out of the browser sandbox and interact with the host operating system. Mozilla fixed the issue in Firefox 154 and Thunderbird 154 through advisories MFSA-2026-74 and MFSA-2026-78. The vulnerability is exploitable over the network without authentication or user interaction.

Critical Impact
A remote attacker can escape the Firefox or Thunderbird sandbox and execute code outside the isolated renderer, compromising confidentiality, integrity, and availability of the underlying system.

Affected Products

Mozilla Firefox versions prior to 154
Mozilla Thunderbird versions prior to 154
Systems running the vulnerable Remote Settings Client component

Discovery Timeline

2026-08-18 - CVE-2026-75874 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-75874

Vulnerability Analysis

The Remote Settings Client is the Firefox subsystem that receives configuration payloads, blocklists, and feature flags from Mozilla's Remote Settings service. This component runs with elevated privileges relative to web content because it operates outside the content sandbox. A weakness in its protection mechanism [CWE-693] allows attacker-controlled data to cross the sandbox boundary. The scope change indicated by the vulnerability means code executing inside a sandboxed renderer can influence resources managed by the parent process. Thunderbird is affected because it reuses the same Gecko platform and Remote Settings pipeline as Firefox.

Root Cause

The root cause is an insufficient protection mechanism in the Remote Settings Client. The component fails to properly enforce the trust boundary between sandboxed content processes and the privileged parent process that consumes remote configuration data. Full technical details are restricted; refer to Mozilla Bug Report #2039972 once access restrictions are lifted.

Attack Vector

Exploitation requires an attacker to deliver crafted content that a vulnerable Firefox or Thunderbird build processes. Because the attack vector is network-based and requires no privileges or user interaction beyond visiting a page or opening a message, a single malicious resource can trigger the sandbox escape. Once escaped, the attacker gains code execution in a context outside the renderer sandbox, expanding access to local files, credentials, and inter-process resources. See the security advisories for exploitation constraints and mitigations.

Detection Methods for CVE-2026-75874

Indicators of Compromise

Firefox or Thunderbird child processes spawning unexpected shells, scripting hosts, or LOLBins
Outbound connections from firefox.exe or thunderbird.exe to non-Mozilla infrastructure impersonating Remote Settings endpoints
Unexpected writes to Firefox profile directories or the settings subfolder outside of update windows
Crash reports or telemetry showing Remote Settings Client faults preceding privileged process activity

Detection Strategies

Inventory installed Firefox and Thunderbird versions across the fleet and flag any build below 154
Alert on browser child processes creating persistence artifacts such as scheduled tasks, run keys, or launch agents
Monitor DNS and TLS SNI for connections resembling firefox.settings.services.mozilla.com to unauthorized destinations

Monitoring Recommendations

Ingest endpoint process, file, and network telemetry into a centralized data lake for correlation across Firefox and Thunderbird hosts
Track Mozilla's advisory feeds (MFSA-2026-74, MFSA-2026-78) for updated indicators
Correlate browser crash events with subsequent parent-process behavior to surface sandbox-escape sequences

How to Mitigate CVE-2026-75874

Immediate Actions Required

Upgrade all Firefox installations to version 154 or later
Upgrade all Thunderbird installations to version 154 or later
Restart browser and mail client processes after patching to ensure the vulnerable component is unloaded
Verify enterprise deployment tools (Group Policy, Intune, Jamf) have pushed the updated builds

Patch Information

Mozilla addressed CVE-2026-75874 in Firefox 154 and Thunderbird 154. Patch details are published in Mozilla Security Advisory MFSA-2026-74 and Mozilla Security Advisory MFSA-2026-78. Administrators managing ESR channels should confirm the corresponding ESR build carries the fix before relying on it.

Workarounds

Restrict egress from endpoints to only Mozilla-owned Remote Settings hostnames until patching completes
Apply application allowlisting to block unauthorized child processes spawned by firefox or thunderbird
Consider temporarily disabling Thunderbird remote content rendering for users who cannot update immediately

bash

# Verify installed Firefox version on Linux endpoints
firefox --version

# Verify Thunderbird version
thunderbird --version

# Windows: query installed version via registry
reg query "HKLM\SOFTWARE\Mozilla\Mozilla Firefox" /v CurrentVersion