CVE-2026-75874

Modified Modified - Updated After Analysis

Sandbox Escape in Firefox Remote Settings Client

Publication date: 2026-08-18

Last updated on: 2026-09-01

Assigner: Mozilla Corporation

Description

Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 140.15, and Thunderbird 153.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-09-01

Generated

2026-09-07

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-06

NVD

CVE-2026-75874

EUVD

EUVD-2026-60674

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox	to 154.0.0 (exc)
mozilla	thunderbird	to 154.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

This is a sandbox escape vulnerability in the Remote Settings Client component of Firefox. It allows malicious code to break out of the sandboxed environment, potentially gaining unauthorized access to the host system.

Detection Guidance

This vulnerability is specific to Firefox versions before 154. Detection involves checking installed Firefox versions. Use commands like 'firefox --version' or 'dpkg -l firefox' on Linux to verify the version. If the version is below 154, the system is vulnerable.

Impact Analysis

If exploited, this vulnerability could allow an attacker to run arbitrary code on your system outside the sandbox. This could lead to data theft, malware installation, or further compromise of your device.

Compliance Impact

The provided CVE data does not include details about compliance impacts on standards like GDPR or HIPAA. The vulnerability involves a sandbox escape in the Remote Settings Client component, which could potentially allow unauthorized access or data exfiltration, but specific compliance implications are not addressed.

Mitigation Strategies

Update Firefox to version 154 or later to address the sandbox escape vulnerability in the Remote Settings Client component.

Hi! I’m here to help you understand CVE-2026-75874. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70