---
id: CVE-2026-74987
title: >-
  Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and
  Firefox 154
summary: >-
  Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and
  Firefox 153. Some of these bugs showed evidence of memory corruption or
  another security-relevant defect and we presume that with enough effort some
  of these coul…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: adp
vendor: Mozilla
product: Firefox
affected:
  - Firefox
  - Thunderbird
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-08-19T13:05:41.543564Z'
published: '2026-08-18'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T16:35:52.498Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74987'
references:
  - url: >-
      https://bugzilla.mozilla.org/buglist.cgi?bug_id=1500946%2C1788109%2C2045379%2C2045380%2C2049339%2C2049393%2C2053580%2C2054662%2C2054665%2C2054673%2C2054785%2C2058645
    label: >-
      Moderate Severity internally found bugs fixed in Firefox ESR 140.14,
      Firefox ESR 153.1 and Firefox 154
  - url: >-
      https://bugzilla.mozilla.org/buglist.cgi?bug_id=2048797%2C2050536%2C2053272%2C2053579%2C2057115%2C2057116%2C2057130%2C2057991%2C2057995%2C2058002%2C2058008%2C2058032%2C2058102%2C2058667
    label: >-
      High Severity internally found bugs fixed in Firefox ESR 140.14, Firefox
      ESR 153.1 and Firefox 154
  - url: 'https://bugzilla.mozilla.org/show_bug.cgi?id=2059424'
    label: >-
      Low Severity internally found bugs fixed in Firefox ESR 140.14, Firefox
      ESR 153.1 and Firefox 154
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-74/'
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-76/'
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-77/'
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-78/'
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-79/'
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-80/'
tags:
  - cve.org
epss: 0.00715
epssPercentile: 0.53869
ingestedAt: '2026-10-28T17:14:44.478Z'
---

## Overview

Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

## Affected

- `Firefox`
- `Thunderbird`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.