by Kastro
Paper/Archive/CVE-2026-74959

CVE-2026-74959

Mozilla Firefox — Mitigation bypass in the Storage: Cache API component

EPSS 0.5%CVSS 9.1
critical.is priorityof 100
36
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 41.3.413 × 208.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Mitigation bypass in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Affected

ProductAffectedFixed inSource
Firefoxsee advisory140.14CNA
Thunderbirdsee advisory140.14CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refbugzilla.mozilla.org/show_bug.cgi?id=2047853refmozilla.org/security/advisories/mfsa2026-74refmozilla.org/security/advisories/mfsa2026-76refmozilla.org/security/advisories/mfsa2026-77refmozilla.org/security/advisories/mfsa2026-78refmozilla.org/security/advisories/mfsa2026-79refmozilla.org/security/advisories/mfsa2026-80