CVE-2026-75874

Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 140.15, and Thunderbird 153.2.

CVSS v3 10.0 CRITICAL

10.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=2039972	Permissions Required
https://www.mozilla.org/security/advisories/mfsa2026-74/	Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-78/	Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-83/
https://www.mozilla.org/security/advisories/mfsa2026-84/
https://www.mozilla.org/security/advisories/mfsa2026-85/
https://www.mozilla.org/security/advisories/mfsa2026-87/
https://www.mozilla.org/security/advisories/mfsa2026-88/

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mozilla:firefox::::::::
	cpe:2.3:a:mozilla:thunderbird::::::::

History

No history.

Information

Published : 2026-08-18 13:17

Updated : 2026-09-01 22:17

NVD link : CVE-2026-75874

Mitre link : CVE-2026-75874

CVE.ORG link : CVE-2026-75874

JSON object : View

Products Affected

mozilla

thunderbird
firefox

CWE

CWE-693

Protection Mechanism Failure

{"id": "CVE-2026-75874", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-75874", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-18T19:23:52.490532Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@mozilla.org", "affectedData": [{"vendor": "Mozilla", "product": "Firefox", "versions": [{"status": "unaffected", "version": "115.40", "versionType": "rpm", "lessThanOrEqual": "115.*"}, {"status": "unaffected", "version": "140.15", "versionType": "rpm", "lessThanOrEqual": "140.*"}, {"status": "unaffected", "version": "153.2", "versionType": "rpm", "lessThanOrEqual": "153.*"}, {"status": "unaffected", "version": "154", "versionType": "rpm", "lessThanOrEqual": "*"}]}, {"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"status": "unaffected", "version": "140.15", "versionType": "rpm", "lessThanOrEqual": "140.*"}, {"status": "unaffected", "version": "153.2", "versionType": "rpm", "lessThanOrEqual": "153.*"}, {"status": "unaffected", "version": "154", "versionType": "rpm", "lessThanOrEqual": "*"}]}]}], "published": "2026-08-18T13:17:43.500", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2039972", "tags": ["Permissions Required"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-74/", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-78/", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-83/", "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-84/", "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-85/", "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-87/", "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-88/", "source": "security@mozilla.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-693"}]}], "descriptions": [{"lang": "en", "value": "Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 140.15, and Thunderbird 153.2."}], "lastModified": "2026-09-01T22:17:12.863", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A5B41DB4-BE24-4724-9CD3-2BBD4FC1FF3E", "versionEndExcluding": "154.0.0"}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F1E6BFE9-856D-44E0-B258-86D06DBAC7EB", "versionEndExcluding": "154.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@mozilla.org"}