CVE-2026-74965

A privilege escalation vulnerability exists in the Shell Integration component of Firefox and Thunderbird. CVSS 8.8 (HIGH) with network attack vector, no privileges required and user interaction needed. CISA reports no known exploitation. Fixed in Firefox 154, Firefox ESR 140.14/153.1, Thunderbir...

CVE-2026-74963

Firefox and Thunderbird suffer a same-origin policy bypass in their Networking: Cookies component, allowing cross-origin access to cookies. CVSS 5.4 (Medium). Fixed in Firefox 154, ESR 140.14, ESR 153.1, Thunderbird 154, 140.14, 153.1. No in-the-wild exploitation reported; user interaction requir...

CVE-2026-74965 Privilege escalation in the Shell Integration component

Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-74967

Firefox and Thunderbird's Audio/Video: Playback component has a same-origin policy bypass (CVSS 5.4, MEDIUM) exploitable via a crafted page requiring user interaction. Fixed in Firefox 154, Firefox ESR 140.14/153.1, Thunderbird 154, and Thunderbird 140.14/153.1. No in-the-wild exploitation report...

CVE-2026-74963 Same-origin policy bypass in the Networking: Cookies component

Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-74964 Integer overflow in the Graphics component

Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-74963 Same-origin policy bypass in the Networking: Cookies component

Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-74967 Same-origin policy bypass in the Audio/Video: Playback component

Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-74967 Same-origin policy bypass in the Audio/Video: Playback component

Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-74964

An integer overflow in Firefox/Thunderbird's Graphics component (CVSS 9.8 critical, network-exploitable with no privileges) enables arbitrary code execution, information disclosure, and denial of service. Fixed in Firefox 154, Firefox ESR 140.14/153.1, Thunderbird 154/140.14/153.1; Debian stable ...

CVE-2026-74960

CVE-2026-74960 is a site isolation issue in the WebExtensions component of Mozilla Firefox and Thunderbird. The vulnerability allows a web extension to bypass site isolation boundaries, potentially enabling cross-origin data access. It carries a CVSS 3.1 score of 8.1 (HIGH) with a vector of AV:N/...

CVE-2026-74960 Site isolation issue in the WebExtensions component

Site isolation issue in the WebExtensions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-74959 Mitigation bypass in the Storage: Cache API component

Mitigation bypass in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-74959

CVE-2026-74959 is a mitigation bypass in the Storage: Cache API component of Mozilla Firefox and Thunderbird . The CVSS 3.1 score is 9.1 (CRITICAL) with a network attack vector, low complexity, no privileges or user interaction required, and high impact on both confidentiality and integrity. CISA...

CVE-2026-74957 Mitigation bypass in the Safe Browsing component

Mitigation bypass in the Safe Browsing component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-74962 Site isolation issue in the Networking: Cookies component

Site isolation issue in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-74959 Mitigation bypass in the Storage: Cache API component

Mitigation bypass in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-74962 Site isolation issue in the Networking: Cookies component

Site isolation issue in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-74960 Site isolation issue in the WebExtensions component

Site isolation issue in the WebExtensions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-74957 Mitigation bypass in the Safe Browsing component

Mitigation bypass in the Safe Browsing component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...