---
id: CVE-2026-74990
title: >-
  Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox
  ESR 153.1 and Firefox 154
summary: >-
  Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13,
  Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of
  memory corruption or another security-relevant defect and we presume that with
  enough effor…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: adp
vendor: Mozilla
product: Firefox
affected:
  - Firefox
  - Thunderbird
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-08-18T19:27:52.706061Z'
published: '2026-08-18'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T16:35:53.190Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74990'
references:
  - url: >-
      https://bugzilla.mozilla.org/buglist.cgi?bug_id=2045762%2C2052401%2C2058208
    label: >-
      Moderate Severity internally found bugs fixed in Firefox ESR 115.39,
      Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154
  - url: >-
      https://bugzilla.mozilla.org/buglist.cgi?bug_id=2045774%2C2048490%2C2050864%2C2053159%2C2053260%2C2053261%2C2053582%2C2053599%2C2053607%2C2053608%2C2053853%2C2054626%2C2054627%2C2054635%2C2054677%2C2054740%2C2054832%2C2056792%2C2057098%2C2057100%2C2057101%2C2057103%2C2057117%2C2057118%2C2058048%2C2058049%2C2058622%2C2058623%2C2058665%2C2058666%2C2059121%2C2059164%2C2059188
    label: >-
      High Severity internally found bugs fixed in Firefox ESR 115.39, Firefox
      ESR 140.14, Firefox ESR 153.1 and Firefox 154
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-74/'
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-75/'
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-76/'
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-77/'
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-78/'
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-79/'
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-80/'
tags:
  - cve.org
epss: 0.00715
epssPercentile: 0.53869
ingestedAt: '2026-10-28T17:14:44.482Z'
---

## Overview

Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

## Affected

- `Firefox`
- `Thunderbird`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.