CVE-2026-74979: 
NixOS vulnerability analysis and mitigation

CVE-2026-74979 is a mitigation bypass vulnerability in the Add-ons Manager component of Mozilla Firefox and Thunderbird. Discovered and reported by Tomoya Nakanishi, it was publicly disclosed on August 18, 2026, as part of Mozilla's coordinated security advisory release. Affected products include Firefox prior to version 154, Firefox ESR prior to 153.1, Thunderbird prior to 154, and Thunderbird ESR prior to 153.1. Mozilla rates this vulnerability as Low impact in its advisories, though Feedly's automated CVSS v3.1 estimate assigns a base score of 9.8 (Critical) — this discrepancy likely reflects conservative automated scoring versus Mozilla's contextual severity assessment (Mozilla Advisory, Mozilla Advisory).

The vulnerability is classified under CWE-284 (Improper Access Control), specifically a security mitigation bypass in Firefox and Thunderbird's Add-ons Manager component (referenced as Bug 2045676 in Mozilla's Bugzilla). The flaw allows an attacker to circumvent existing security controls that govern add-on installation or validation, potentially enabling the installation of malicious add-ons that would otherwise be blocked. No authentication or user interaction is required based on the CVSS vector, and the attack can be conducted over the network. The Bugzilla entry for this issue is not publicly accessible, limiting detailed technical analysis of the exact bypass mechanism (Mozilla Advisory, Mozilla Advisory).

Successful exploitation could allow an unauthenticated network attacker to bypass Add-ons Manager security mitigations, potentially enabling the installation of malicious browser extensions or add-ons without proper validation. Such malicious add-ons could lead to arbitrary code execution within the browser context, data theft, credential harvesting, or persistent access to the affected system. Mozilla's own severity rating for this CVE is Low, suggesting the practical exploitability or real-world impact may be constrained by additional browser security layers or specific preconditions not yet publicly detailed (Mozilla Advisory, Mozilla Advisory).

As of the disclosure date (August 18, 2026), there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is reported as 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported in connection with this CVE.

Mozilla has released patches addressing this vulnerability in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird ESR 153.1. Users and administrators should update to these versions or later immediately. As an additional precaution, organizations should audit installed browser add-ons and remove any that are not from trusted, verified sources, as this vulnerability could be leveraged to install malicious extensions that bypass security checks (Mozilla Advisory, Mozilla Advisory, Mozilla Advisory).