Mozilla Firefox — CVE-2026-74940 (Critical)

Date Aug 18, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product Mozilla · Firefox

CVE CVE-2026-74940

Critical vendor advisory CVE-2026-74940

Summary

Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 9.8) in Mozilla Firefox. Patch or mitigate promptly. EPSS percentile: 6%.

Operator check

Review CVE-2026-74940 in your asset inventory. Apply patches per vendor guidance and verify Firefox is not exposed. CVSS score: 9.8. EPSS probability: 0.2%; percentile: 6%.

Sources

NVD — CVE-2026-74940 Source reference Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed