Search CVEs, research… / diras.sa

CVE-2026-75874: sandbox escape in Mozilla Firefox

A remote attacker can escape the sandbox in the Remote Settings Client component, allowing code to run outside expected confinement on Mozilla products (CVE-2026-75874). Specific affected releases are not listed in the supplied facts; third-party reports reference Firefox and Thunderbird components. The vulnerability is remotely reachable without authentication or user interaction, so an attacker only needs network access to target affected installations.

Published Updated Source: CVE Program, NVD, FIRST EPSS

CVSS 3.1
10CRITICAL
EPSS
0.00455
CWE
CWE-693
KEV DUE DATE
Not listed
PATCH
Not yet

DIRAS TAKE

Treat this as urgent: the flaw can be triggered remotely with no authentication or user interaction, so reduce exposure of affected clients and apply vendor guidance as soon as fixes are published.

What is CVE-2026-75874?

A remote attacker can escape the sandbox in the Remote Settings Client component, allowing code to run outside expected confinement on Mozilla products (CVE-2026-75874). Specific affected releases are not listed in the supplied facts; third-party reports reference Firefox and Thunderbird components. The vulnerability is remotely reachable without authentication or user interaction, so an attacker only needs network access to target affected installations.

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Which versions of Mozilla Firefox are affected?

BRANCHAFFECTEDFIXED

Is CVE-2026-75874 being exploited?

There are no public reports of active exploitation as of 2026-09-29.

How to fix CVE-2026-75874

  1. Follow Mozilla's security advisories and apply vendor patches immediately when released.
  2. Limit network exposure of client installations and block unnecessary remote access to update/configuration endpoints.
  3. Increase logging and monitor for anomalous behavior from the Remote Settings Client process.
  4. Temporary mitigations from Mozilla's guidance: disable or restrict the Remote Settings Client where possible until a patch is installed.

Frequently asked questions

Is CVE-2026-75874 being actively exploited?

No public reports of exploitation were available as of 2026-09-29.

Which Firefox versions are affected by CVE-2026-75874?

The supplied facts do not list specific affected versions; third-party reporting references the Remote Settings Client in Firefox and Thunderbird but does not provide an official affected-versions list here.

Is there a patch for CVE-2026-75874?

No patch was available in the provided facts as of 2026-09-29; monitor Mozilla security advisories for released fixes and install them promptly.

Does CVE-2026-75874 require authentication?

No, the vulnerability can be triggered without authentication or user interaction, so it is remotely exploitable with network access.

References