Security readout for executives and security teams
Plain-English summary
A flaw in Firefox and Thunderbird could let malicious web content cross browser security boundaries and access or alter data belonging to another site. No user interaction or prior access is reflected in the supplied CVSS rating. Mozilla states the issue is fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
Executive priority
Prioritize emergency patching because successful exploitation could compromise sensitive browser or email data without stated user interaction. Establish exposure from endpoint inventory immediately, then track remediation by product channel. Escalate systems handling privileged accounts, sensitive communications, or valuable web sessions.
Technical view
CVE-2026-74956 is a same-origin policy bypass in Mozilla's DOM Service Workers component, associated with CWE-843. Its CVSS 3.1 score is 9.1 (network-accessible, low complexity, no privileges or interaction), with high confidentiality and integrity impact but no stated availability impact. The bundle does not provide the underlying flaw mechanics.
Likely exposure
Organizations using Firefox or Thunderbird releases below the applicable fixed version may be exposed. The bundle does not provide precise vulnerable-version ranges, deployment conditions, or platform limitations, so teams should confirm affected versions against Mozilla's channel-specific advisories and their software inventory.
Exploitation context
The supplied record is not in CISA KEV, and no provided source states that exploitation is active. The CVSS vector indicates remote exploitation without privileges or user interaction, but it does not prove practical exploitability or observed attacks. Treat the issue urgently without describing it as exploited in the wild.
Researcher notes
The record attributes the bypass to DOM Service Workers and maps it to CWE-843, but supplies no root-cause, precondition, or proof-of-concept detail. Exact vulnerable ranges are also absent. Avoid inferring that versions 153.1 or 154 are affected; the description explicitly identifies them as fixed releases.
Mitigation direction
- Upgrade Firefox to 154 or Firefox ESR to 153.1, as applicable.
- Upgrade Thunderbird to 154 or Thunderbird 153.1, as applicable.
- Use Mozilla's channel-specific advisories to confirm release and platform coverage.
- Prioritize managed endpoints handling sensitive web, email, or authenticated session data.
Validation and detection
- Inventory installed Firefox and Thunderbird versions across endpoints.
- Confirm each installation meets its applicable fixed release level.
- Verify managed update policies successfully deployed the corrected versions.
- Review Mozilla advisories for platform-specific scope or additional instructions.
- Monitor vendor and threat-intelligence updates for exploitation evidence.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-843: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-74956 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N3.95.2CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://bugzilla.mozilla.org/show_bug.cgi?id=2032406CVE reference, mozilla
- https://www.mozilla.org/security/advisories/mfsa2026-74/CVE reference, mozilla
- https://www.mozilla.org/security/advisories/mfsa2026-77/CVE reference, mozilla
- https://www.mozilla.org/security/advisories/mfsa2026-78/CVE reference, mozilla
- https://www.mozilla.org/security/advisories/mfsa2026-80/CVE reference, mozilla
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Access of Resource Using Incompatible Type
Access of Resource Using Incompatible Type represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.