EXPOSURES › CVE-2026-74944
CVE-2026-74944
CRITICALMozilla Firefox and Thunderbird contained a critical use-after-free vulnerability in the DOM component that was patched in versions 154 and 140.14.
A use-after-free flaw in Firefox and Thunderbird's DOM core allowed remote code execution if exploited, but was patched in the latest releases. DIB organizations must ensure their browsers and email clients are updated to prevent exploitation of such critical flaws, as unpatched versions could lead to system compromise or data theft.
Shame score — A critical CVSS 9.8 use-after-free flaw in a widely used browser and email client was exploitable until patched, representing a significant exposure for unpatched systems.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.