Critical severity10.0NVD Advisory· Published Aug 18, 2026· Updated Sep 1, 2026
CVE-2026-75874
CVE-2026-75874
Description
Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
13- osv-coords11 versionspkg:rpm/almalinux/thunderbirdpkg:rpm/almalinux/firefox-x11pkg:apk/chainguard/firefoxpkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Tumbleweedpkg:rpm/almalinux/firefoxpkg:apk/wolfi/firefoxpkg:apk/chainguard/firefox-docker-selenium-compatpkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/firefox-esr&distro=openSUSE%20Tumbleweedpkg:apk/wolfi/firefox-docker-selenium-compatpkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Tumbleweed
< 140.16.0-1.el9_8.alma.1+ 10 more
- (no CPE)range: < 140.16.0-1.el9_8.alma.1
- (no CPE)range: < 140.15.0-1.el9_8.alma.1
- (no CPE)range: < 154.0-r0
- (no CPE)range: < 140.15.0-1.1
- (no CPE)range: < 140.15.0-1.el10_2
- (no CPE)range: < 154.0-r0
- (no CPE)range: < 154.0-r0
- (no CPE)range: < 153.2.0-160000.1.1
- (no CPE)range: < 153.2.0-1.1
- (no CPE)range: < 154.0-r0
- (no CPE)range: < 154.0-1.1
- Range: >=154
- Range: >=154
Patches
Vulnerability mechanics
References
6- www.mozilla.org/security/advisories/mfsa2026-74/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2026-78/nvdVendor Advisory
- bugzilla.mozilla.org/show_bug.cginvdPermissions Required
- www.mozilla.org/security/advisories/mfsa2026-83/nvd
- www.mozilla.org/security/advisories/mfsa2026-84/nvd
- www.mozilla.org/security/advisories/mfsa2026-85/nvd
News mentions
2- ⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and MoreThe Hacker News · Aug 24, 2026
- Mozilla Thunderbird: 25 Vulnerabilities Disclosed, Ranging from Critical to Medium SeverityVypr Intelligence · Aug 18, 2026