CVE-2026-74990
Received Received - Intake

Memory Corruption Vulnerabilities in Firefox ESR and Firefox

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: Mozilla Corporation

Description
Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, and Firefox ESR 153.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-74990
EUVD
EUVD-2026-60673

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
mozilla firefox to 154 (exc)
mozilla firefox to 115.39 (exc)
mozilla firefox to 140.14 (exc)
mozilla firefox 115.39
mozilla firefox 140.14
mozilla firefox 153.1
mozilla firefox 154

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-74990 involves security flaws found in multiple Firefox ESR versions (115.38, 140.13, 153.0) and Firefox 153. These bugs include memory corruption and other security-relevant defects that could potentially be exploited with enough effort. Mozilla fixed the issues in later versions like Firefox ESR 115.39, ESR 140.14, ESR 153.1, and Firefox 154.

Detection Guidance

Detect affected Firefox versions by checking installed versions with commands like 'firefox --version' or 'apt list --installed | grep firefox' on Linux. Compare against vulnerable versions: Firefox ESR 115.38, 140.13, 153.0 or Firefox 153.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary code, crash the browser, or gain unauthorized access to sensitive data. Users running vulnerable Firefox versions are at risk until they update to the patched releases.

Compliance Impact

This vulnerability involves memory corruption and security defects in Firefox browsers, which could potentially be exploited. While not explicitly linked to compliance standards, such vulnerabilities may pose risks to data confidentiality and integrity, which are key concerns under GDPR and HIPAA. Organizations handling sensitive data should assess the impact based on their specific use of affected Firefox versions.

Mitigation Strategies

Update Firefox to the latest patched versions: Firefox 154, Firefox ESR 115.39, 140.14, or 153.1. Use your package manager to upgrade (e.g., 'apt upgrade firefox' on Debian/Ubuntu).

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74990. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart