by Kastro
Paper/Archive/CVE-2026-74936

CVE-2026-74936

Mozilla Firefox — Use-after-free in the JavaScript: WebAssembly component

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 48.3.483 × 209.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Affected

ProductAffectedFixed inSource
Firefoxsee advisory140.14CNA
Thunderbirdsee advisory140.14CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refbugzilla.mozilla.org/show_bug.cgi?id=2052688refmozilla.org/security/advisories/mfsa2026-74refmozilla.org/security/advisories/mfsa2026-76refmozilla.org/security/advisories/mfsa2026-77refmozilla.org/security/advisories/mfsa2026-78refmozilla.org/security/advisories/mfsa2026-79refmozilla.org/security/advisories/mfsa2026-80