CVE-2026-74940

Mozilla Firefox and Thunderbird suffered a critical use-after-free vulnerability in the Graphics: Text component, patched in versions 154 and ESR 115.39.

A use-after-free flaw in Firefox and Thunderbird's text rendering component allowed remote code execution, requiring urgent patching to prevent exploitation. DIB organizations must ensure their browsers are updated to mitigate this critical CVE, as unpatched instances could lead to system compromise and data breaches.

Shame score — A critical use-after-free vulnerability in a widely used browser component was exploitable for remote code execution, representing a significant security lapse in a foundational software product.