CVE-2026-74955: 
NixOS Schwachstellenanalyse und -minderung

CVE-2026-74955 is a privilege escalation vulnerability in the Request Handling component of Mozilla Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR. Reported by researcher "jmwebdevelopement" and disclosed on August 18, 2026, it affects Firefox versions prior to 154.0, Firefox ESR versions prior to 153.1, Thunderbird versions prior to 154.0, and Thunderbird ESR versions prior to 153.1. Mozilla rates its impact as moderate, while the NVD assigns a CVSS v3.1 base score of 8.8 (High) (Mozilla Advisory mfsa2026-74, Mozilla Advisory mfsa2026-77).

The vulnerability is classified as CWE-269 (Improper Privilege Management), indicating that the Request Handling component fails to correctly enforce privilege boundaries during request processing. The attack vector is network-based and requires user interaction (e.g., visiting a malicious page or opening a crafted message), but no prior privileges are needed. The underlying bug is tracked as Mozilla Bug 2029265, though the bug report is access-restricted and no public technical write-up or proof-of-concept code has been released at this time (Mozilla Advisory mfsa2026-74, Mozilla Advisory mfsa2026-77).

Successful exploitation could allow an attacker to escalate privileges within the browser context, potentially gaining capabilities beyond those normally granted to web content. The CVSS assessment indicates high confidentiality, integrity, and availability impact, suggesting that a fully realized exploit could lead to significant data exposure, unauthorized modification of browser state or local resources, and disruption of application availability. The scope is limited to the affected browser/email client process, but privilege escalation within the browser could serve as a stepping stone for further exploitation of the underlying system (Mozilla Advisory mfsa2026-74, Mozilla Advisory mfsa2026-77).

As of the disclosure date (August 18, 2026), there is no evidence of in-the-wild exploitation, no public proof-of-concept code, and no threat actor attribution associated with this vulnerability. The NVD SSVC assessment indicates exploitation is "none" and the vulnerability is not automatable, requiring user interaction to trigger. The EPSS score is reported as 0.0, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog (Mozilla Advisory mfsa2026-74, Mozilla Advisory mfsa2026-77).

Mozilla has released patched versions addressing this vulnerability: Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird ESR 153.1. Users and administrators should update to these versions or later immediately. No configuration-based workarounds have been published; upgrading is the only recommended remediation (Mozilla Advisory mfsa2026-74, Mozilla Advisory mfsa2026-77).

Mozilla published coordinated security advisories (MFSA2026-74, MFSA2026-77, MFSA2026-78, MFSA2026-80) on August 18, 2026, covering this and numerous other vulnerabilities fixed in the same release cycle. Automated vulnerability tracking services such as cvefeed.io, vulners.com, and VulDB indexed the CVE shortly after disclosure. No notable independent researcher commentary or significant social media discussion specific to CVE-2026-74955 has been identified beyond standard vulnerability aggregation (Mozilla Advisory mfsa2026-74, Mozilla Advisory mfsa2026-77).