Mozilla Product Security Update Advisory
Mozilla Security Update Advisory.
Mozilla has released security updates to address several vulnerabilities in Firefox, Firefox ESR, and Thunderbird.
Affected Products and Versions.
- Firefox versions prior to 154.
- Firefox ESR versions prior to 115.39.
- Firefox ESR versions prior to 140.14.
- Firefox ESR versions prior to 153.1.
- Thunderbird versions prior to 140.14.
- Thunderbird versions prior to 153.1.
- Thunderbird versions prior to 154.
Resolved Vulnerabilities.
- CVE-2026-74934 is a site isolation vulnerability in the Graphics: CanvasWebGL component of Firefox, Firefox ESR, and Thunderbird.
- CVE-2026-74936 is a use-after-free vulnerability in the JavaScript: WebAssembly component of Firefox, Firefox ESR, and Thunderbird.
- CVE-2026-74940 is a use-after-free vulnerability in the Graphics: Text component of Firefox, Firefox ESR, and Thunderbird.
- CVE-2026-74943 is a use-after-free vulnerability in the Graphics: ImageLib component of Firefox, Firefox ESR, and Thunderbird.
- CVE-2026-74944 is a use-after-free vulnerability affecting the DOM: Core & HTML component in Firefox, Firefox ESR, and Thunderbird.
- CVE-2026-74987 is a memory corruption or other security-related vulnerability affecting Firefox, Firefox ESR, and Thunderbird.
- CVE-2026-74988 is a memory corruption or other security-related vulnerability affecting Firefox, Firefox ESR, and Thunderbird.
Response.
Vulnerability Patches have been released in the latest updates, and users of the affected products should update to the latest version with Vulnerability Patches following the instructions on the reference sites.
Reference Sites.
- Mozilla Foundation Security Advisory 2026-74.
- Mozilla Foundation Security Advisory 2026-75.
- Mozilla Foundation Security Advisory 2026-76.
- Mozilla Foundation Security Advisory 2026-77.
- Mozilla Foundation Security Advisory 2026-78.
- Mozilla Foundation Security Advisory 2026-79.
- Mozilla Foundation Security Advisory 2026-80.
