CVE-2026-74989: Internally found bugs fixed in Thunderbird 154
Internally found bugs present in Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited.
Other sources
Internally found bugs present in Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 154 - Upgrade
Upgrade
Mozilla Firefoxto a version that resolves this vulnerability.Fixed in 154 - Upgrade
Upgrade
Mozilla Thunderbirdto a version that resolves this vulnerability.Fixed in 154
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-75874
- CVE-2026-74934
- CVE-2026-74935
- CVE-2026-74936
- CVE-2026-74937
- CVE-2026-74938
- CVE-2026-74939
- CVE-2026-74940
- CVE-2026-74941
- CVE-2026-74942
- CVE-2026-74943
- CVE-2026-74944
- CVE-2026-74945
- CVE-2026-74946
- CVE-2026-74947
- CVE-2026-74948
- CVE-2026-74949
- CVE-2026-74950
- CVE-2026-74951
- CVE-2026-74952
- CVE-2026-74953
- CVE-2026-74954
- CVE-2026-74955
- CVE-2026-74956
- CVE-2026-74957
- CVE-2026-74958
- CVE-2026-74959
- CVE-2026-74960
- CVE-2026-74961
- CVE-2026-74962
- CVE-2026-74963
- CVE-2026-74964
- CVE-2026-74965
- CVE-2026-74966
- CVE-2026-74967
- CVE-2026-74968
- CVE-2026-74969
- CVE-2026-74970
- CVE-2026-74971
- CVE-2026-74972
- CVE-2026-74973
- CVE-2026-74974
- CVE-2026-74975
- CVE-2026-74976
- CVE-2026-74977
- CVE-2026-74978
- CVE-2026-74979
- CVE-2026-74980
- CVE-2026-74981
- CVE-2026-74982
- CVE-2026-74983
- CVE-2026-74984
- CVE-2026-74985
- CVE-2026-74986
- CVE-2026-74987
- CVE-2026-74988
- CVE-2026-74989
- CVE-2026-74990
- CVE-2026-84637
Frequently Asked Questions
Which Firefox versions are known to be affected or fixed?
Firefox 153 is affected. The issue was fixed in Firefox 154.
Is exploitation known to be practical?
The affected bugs were internally found and showed evidence of memory corruption or another security-relevant defect. Mozilla states that some could potentially have been exploited with enough effort, but the available information does not specify attacker prerequisites or a confirmed exploitation method.