Skip to main content

Mozilla Firefox CVE-2026-74983

| EUVDEUVD-2026-60671 HIGH
Protection Mechanism Failure (CWE-693)
2026-08-18 mozilla GHSA-2m2p-42ph-26v7
Authentication Bypass Red Hat Mozilla Suse
High
Disputed · 8.1 Vendor: mozilla
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Deliver malicious web content via phishing or web
  2. Exploit
    Victim visits and interacts with attacker-controlled page
  3. Execution
    Trigger DLP component protection bypass in Firefox
  4. Impact
    Exfiltrate sensitive data that DLP would have blocked

Vulnerability Assessment

Weakness
CWE
CWE-693
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Protection mechanism completeness
Exploitation Conditions

User interaction is required - the victim must visit or interact with attacker-controlled content (UI:R per CVSS vector). No authentication or special privileges are required from the attacker's side (PR:N). The vulnerability targets the Data Loss Prevention component specifically, meaning exploitation impact is most relevant in enterprise Firefox deployments where DLP controls are actively configured and enforced. Exploitation is limited by the mandatory user-interaction step, which prevents passive or automated mass-exploitation. Scope is unchanged (S:U), so the impact is confined to the Firefox process itself - no cross-system privilege escalation is indicated.
Impact

The CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) reflects a high-severity network-exploitable flaw requiring no authentication, though user interaction is a necessary prerequisite. The high C and I scores indicate potential for both data exposure and integrity compromise through DLP control bypass. In contrast, the EPSS score of 0.17% (7th percentile) is notably low, suggesting no significant real-world exploitation activity has been observed by the time of this analysis. There is no CISA KEV entry confirming active exploitation, and no public POC has been identified. The practical risk is therefore attenuated by the UI:R requirement, which eliminates passive drive-by exploitation, and the very low EPSS, which further contextualizes this as a lower-priority item despite the CVSS score. Defenders with enterprise Firefox deployments relying on DLP controls should treat this as a medium-priority patch, while consumer Firefox users face minimal realistic threat absent a known active campaign.
Exploit ScenarioDerived

An attacker crafts a malicious web page or delivers content via a phishing link that, when visited by a Firefox user, exploits the DLP bypass to silently exfiltrate sensitive data the browser has processed (e.g., form data, clipboard content, or locally stored credentials) in a manner that Firefox's DLP mechanism would normally detect and block. No public POC is known at the time of analysis, and the attack requires the victim to actively interact with the malicious content.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 19, 2026

Protection mechanism failure in Firefox's Data Loss Prevention (DLP) component allows remote attackers, with user interaction, to bypass DLP controls, resulting in high confidentiality and integrity impact. Affected versions span the standard Firefox release channel (prior to 154) and both active ESR branches (ESR 140.x prior to 140.14, ESR 153.x prior to 153.1). No public exploit exists and EPSS sits at 0.17% (7th percentile), indicating low observed exploitation probability despite the high CVSS score - no active exploitation is confirmed via CISA KEV.

RemediationAI

Upgrade to Firefox 154 (standard release), Firefox ESR 140.14, or Firefox ESR 153.1 to apply vendor-released patches. The fix is confirmed across all three actively maintained Firefox branches per Mozilla's security advisories at https://www.mozilla.org/security/advisories/mfsa2026-74/ and associated MFSA entries. For enterprise environments where immediate patching is not feasible, consider disabling or restricting access to the affected DLP component through enterprise policy settings (via Firefox's enterprise policy JSON or Group Policy), though this removes DLP protections entirely and should be treated as a temporary trade-off. There are no other vendor-recommended workarounds described in the available advisory data.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

CWE-693 (Protection Mechanism Failure) describes flaws where a product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks. In this context, Firefox's Data Loss Prevention component - an enterprise-grade control designed to prevent unauthorized exfiltration or leakage of sensitive data processed by the browser - can be bypassed. The CPE string cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* covers all Firefox application variants across platforms. Multiple Mozilla Security Advisory (MFSA) references (mfsa2026-74, mfsa2026-76, mfsa2026-77, mfsa2026-78, mfsa2026-79, mfsa2026-80) suggest this issue may be cross-tracked across several advisory bundles, possibly indicating shared root cause or related component fixes in the same release cycle. The bug tracker reference at bugzilla.mozilla.org/show_bug.cgi?id=2051897 is the upstream defect record.

Know when Mozilla gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–High)
Vendor (mozilla) PRIMARY 8.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
vuln.today AI 8.1 HIGH

Network-delivered exploit requiring active user interaction; no auth needed; DLP bypass yields high C and I but no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 3.4 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: mozilla

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

3
CVSS changed
Aug 19, 2026 - 14:22 NVD
8.1 (HIGH)
CVE Published
Aug 18, 2026 - 12:23 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 18, 2026 - 12:23 cve.org
HIGH 8.1

DescriptionCVE.org

Mitigation bypass in the Data Loss Prevention component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1.

Executive ViewAI

Why It Matters

A vulnerability in Firefox's Data Loss Prevention component (affecting versions prior to 154 and specific ESR branches) enables remote attackers to bypass organizational data protection controls through user interaction, creating risk of confidential data disclosure. This directly threatens organizations relying on Firefox with integrated DLP policies. Patched versions (154, ESR 140.14, ESR 153.1) are available from Mozilla and should be deployed immediately.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 93% exploitable
Prevalence
High
major browser deployed across enterprise and consumer environments globally
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

40
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +40
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Affected Products (CPE)CVE.org

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

More in Mozilla

View all
CVE-2015-4495 HIGH POC
8.8 Aug 08

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote
CVE-2013-1690 HIGH POC
8.8 Jun 26

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before

CVE-2013-0758 CRITICAL POC
9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
CVE-2013-0753 CRITICAL POC
9.3 Jan 13

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
CVE-2012-3993 CRITICAL POC
9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
CVE-2013-1710 CRITICAL POC
10.0 Aug 07

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
CVE-2017-3823 HIGH POC
8.8 Feb 01

An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
CVE-2014-8636 HIGH POC
7.5 Jan 14

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with

CVE-2013-0757 CRITICAL POC
9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
CVE-2014-1510 CRITICAL POC
9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
CVE-2014-1511 CRITICAL POC
9.8 Mar 19

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
CVE-2013-0643 HIGH
8.8 Feb 27

The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and b

Same weakness CWE-693 – Protection Mechanism Failure

View all
CVE-2013-2465 CRITICAL POC
9.8
CVE-2024-21412 HIGH POC
8.1
CVE-2019-1003030 CRITICAL POC
9.9
CVE-2013-0431 LOW POC
3.7
CVE-2025-40536 HIGH POC
8.1
CVE-2024-38217 MEDIUM POC
5.4
CVE-2026-21513 HIGH
8.8
CVE-2026-21510 HIGH POC
8.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/kiosk/firefox-esr:140.14-75.12 Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Desktop Applications 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-74983 ADVISORY https://vuldb.com/vuln/391628 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3658/ REF https://bugzilla.mozilla.org/show_bug.cgi?id=2051897 REF https://www.mozilla.org/security/advisories/mfsa2026-74/ REF https://www.mozilla.org/security/advisories/mfsa2026-76/ REF https://www.mozilla.org/security/advisories/mfsa2026-77/ REF https://www.mozilla.org/security/advisories/mfsa2026-78/ REF https://www.mozilla.org/security/advisories/mfsa2026-79/ REF https://www.mozilla.org/security/advisories/mfsa2026-80/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy