CVE-2026-74936

Mozilla's Firefox and Thunderbird contained a critical use-after-free vulnerability in the WebAssembly component that was patched in version 154.

A use-after-free flaw in Firefox and Thunderbird's WebAssembly component allowed attackers to execute arbitrary code remotely. DIB organizations must ensure their browsers and email clients are patched to the latest versions to prevent exploitation, as this vulnerability was not actively exploited in the KEV catalog but represents a significant compliance risk if unpatched.

Shame score — A critical CVSS 9.8 use-after-free vulnerability in a widely deployed browser and email client that required a patch to mitigate, indicating a failure in timely patch management for a high-impact attack surface.