CVE-2026-74958

Information disclosure in the WebRTC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

• CWE-1021

• https://bugzilla.mozilla.org/show_bug.cgi?id=2045368Permissions Required
• https://www.mozilla.org/security/advisories/mfsa2026-74/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2026-77/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2026-78/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2026-80/Vendor Advisory

Published

Aug 18, 2026

Last Modified

Aug 19, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-74952Privilege escalation in the Application Update component. Th…8.8
• CVE-2026-74953Privilege escalation in the Networking: Cookies component. T…8.8
• CVE-2026-74954Information disclosure due to side-channel in the Storage: C…7.5
• CVE-2026-74955Privilege escalation in the Request Handling component. This…8.8
• CVE-2026-74956Same-origin policy bypass in the DOM: Service Workers compon…9.1
• CVE-2026-74957Mitigation bypass in the Safe Browsing component. This vulne…8.1
• CVE-2026-74959Mitigation bypass in the Storage: Cache API component. This …9.1
• CVE-2026-74960Site isolation issue in the WebExtensions component. This vu…8.1
• CVE-2026-74961Side-channel in the Web Audio component. This vulnerability …9.1
• CVE-2026-74962Site isolation issue in the Networking: Cookies component. T…8.1
• CVE-2026-74963Same-origin policy bypass in the Networking: Cookies compone…5.4
• CVE-2026-74964Integer overflow in the Graphics component. This vulnerabili…9.8