Buffer overflow in Mozilla products - CVE-2026-74990
Published: August 18, 2026
Vulnerability identifier: #VU144057
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-74990
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to memory corruption or another security-relevant defect in multiple unspecified components when rendering content or handling browser operations. A remote attacker can trigger crafted browser interactions to execute arbitrary code.
Multiple internally found bugs are covered by this entry, and the advisory notes that some showed evidence of memory corruption or another security-relevant defect.
Affected software
Mozilla Firefox
Firefox ESR
Firefox for Android
Firefox ESR
Firefox for Android
How to mitigate CVE-2026-74990
Install security update from vendor's website.
Mozilla Firefox - update to 154.0
Firefox for Android - update to 154.0
Firefox ESR - addressed in versions 115.39.0, 140.14.0, 153.1.0
Firefox for Android - update to 154.0
Firefox ESR - addressed in versions 115.39.0, 140.14.0, 153.1.0
External References
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-75/
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-77/
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-76/
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-74/
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2045774
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2048490
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2050864
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2053159
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2053260
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2053261
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2053582
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2053599
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2053607
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2053608
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2053853
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2054626
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2054627
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2054635
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2054677
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2054740
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2054832
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2056792
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2057098
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2057100
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2057101
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2057103
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2057117
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2057118
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2058048
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2058049
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2058622
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2058623
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2058665
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2058666
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2059121
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2059164
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2059188
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2045762
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2052401
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2058208