---
id: CVE-2026-74988
title: Internally found bugs fixed in Firefox ESR 153.1 and Firefox 154
summary: >-
  Internally found bugs present in Firefox ESR 153.0 and Firefox 153. Some of
  these bugs showed evidence of memory corruption or another security-relevant
  defect and we presume that with enough effort some of these could have been
  exploite…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: adp
vendor: Mozilla
product: Firefox
affected:
  - Firefox
  - Thunderbird
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-08-20T15:49:14.319860Z'
published: '2026-08-18'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T16:36:00.904Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74988'
references:
  - url: >-
      https://bugzilla.mozilla.org/buglist.cgi?bug_id=2018164%2C2045404%2C2045507%2C2045711%2C2052403%2C2053174%2C2054643%2C2054667%2C2054671%2C2054674%2C2054687%2C2054717%2C2054761%2C2054787%2C2055676%2C2056779%2C2056781%2C2058629%2C2059019%2C2059138
    label: >-
      Moderate Severity internally found bugs fixed in Firefox ESR 153.1 and
      Firefox 154
  - url: >-
      https://bugzilla.mozilla.org/buglist.cgi?bug_id=2045796%2C2046734%2C2051424%2C2054721%2C2057994%2C2058094%2C2058611%2C2058615%2C2058616%2C2061315
    label: >-
      High Severity internally found bugs fixed in Firefox ESR 153.1 and Firefox
      154
  - url: >-
      https://bugzilla.mozilla.org/buglist.cgi?bug_id=2053153%2C2053262%2C2054763%2C2059198%2C2059224
    label: >-
      Low Severity internally found bugs fixed in Firefox ESR 153.1 and Firefox
      154
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-74/'
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-77/'
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-78/'
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-80/'
tags:
  - cve.org
epss: 0.00609
epssPercentile: 0.49264
ingestedAt: '2026-10-28T17:14:44.475Z'
---

## Overview

Internally found bugs present in Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

## Affected

- `Firefox`
- `Thunderbird`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.