CVE-2026-74973
Undergoing Analysis Undergoing Analysis - In Progress

Race Condition and Use-After-Free in Firefox

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: Mozilla Corporation

Description
Race condition, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, and Firefox ESR 153.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-74973
EUVD
EUVD-2026-60668

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
mozilla firefox to 154 (inc)
mozilla firefox_esr to 115.39 (inc)
mozilla firefox_esr to 140.14 (inc)
mozilla firefox_esr to 153.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a race condition and use-after-free vulnerability in Firefox's Graphics component. A race condition occurs when two or more threads access shared data simultaneously, leading to unpredictable behavior. Use-after-free happens when a program continues to use memory after it has been freed, potentially causing crashes or arbitrary code execution.

Detection Guidance

This vulnerability is a race condition and use-after-free in Firefox's Graphics component. Detection requires checking Firefox version against patched releases (Firefox 154, ESR 115.39, ESR 140.14, ESR 153.1). Use commands like 'firefox --version' or check about:support in Firefox to verify version.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code, crash the application, or gain unauthorized access to sensitive data. It primarily affects users of vulnerable Firefox versions by compromising browser stability and security.

Compliance Impact

The provided CVE data does not specify how this vulnerability impacts compliance with standards like GDPR or HIPAA. The description only mentions a race condition and use-after-free in the Graphics component, fixed in specific Firefox versions.

Mitigation Strategies

Immediately update Firefox to version 154 or Firefox ESR to 115.39, 140.14, or 153.1. Disable automatic graphics rendering if updates are delayed by setting MOZ_USE_XINPUT2=0 in environment variables.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74973. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart