CVE-2026-75874 is a sandbox escape in the Remote Settings Client component of Mozilla Firefox and Thunderbird, fixed in version 154 on August 18, 2026. Two severity figures circulate for it and they disagree. NVD carries CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), but that is a CISA-ADP secondary enrichment score, not a vendor rating: NVD's own status is still "Undergoing Analysis" and it has assigned no primary CVSS and no primary CWE. Mozilla, the CNA, rates the issue high, not critical. The underlying bug, Bugzilla 2039972, is access-restricted, which is routine for Mozilla security bugs, so no technical detail about the flaw is public. It is absent from the CISA KEV catalog, FIRST has published no EPSS score for it, and no proof of concept or in-the-wild reporting has surfaced. CISA's SSVC record reads exploitation: none, automatable: yes, technical impact: total.
That gap matters operationally, so this write-up separates what Mozilla documented from what the enrichment score asserts.
Am I vulnerable?
Exposure is a function of one number: the application major version. Mozilla published no lower bound, stating only that the flaw "was fixed in Firefox 154 and Thunderbird 154", so "all versions prior to 154" is an inference from the fixed version and the true introduction point is unknown.
Affected versions
| Product and channel |
Status |
| Firefox (rapid release) |
Vulnerable below 154. Fixed in 154 (MFSA 2026-74) |
| Thunderbird (rapid release) |
Vulnerable below 154. Fixed in 154 (MFSA 2026-78) |
| Firefox ESR 115.x, 140.x, 153.x |
Not listed as affected. Absent from MFSA 2026-75, 2026-76, 2026-77 |
| Thunderbird ESR 140.x, 153.x |
Not listed as affected. Absent from MFSA 2026-79, 2026-80 |
The ESR position is worth reading precisely. All five ESR advisories published the same day omit this CVE, and no ESR fix exists for it. Mozilla never affirmatively states that ESR is unaffected, so treat ESR as "not listed" rather than "confirmed safe", and do not close an ESR ticket on the strength of that absence alone.
Diagnostic commands
All read-only. Run them as the logged-in user.
One caveat on interpretation: a Thunderbird reading of 140.x or 153.x is an ESR build, which lands in the "not listed as affected" row above rather than being a confirmed hit.
Vulnerability
CISA-ADP classifies the flaw as CWE-693, Protection Mechanism Failure, as a secondary weakness. Mozilla's advisory text is a single line: "Sandbox escape in the Remote Settings Client component", credited to the reporter crixer. There is no patch diff, no root cause, and no affected code path in public, and the referenced Bugzilla entry returns an authorization error. Nothing about the mechanism should be asserted, and nothing is asserted here.
What can be described is the component. Remote Settings is Mozilla's signed configuration channel, a Kinto-backed REST service plus a Gecko client that keeps security-relevant data evergreen: the add-on, plugin and graphics-driver blocklists, intermediate CA preloading, CRLite revocation data, and search provider configuration. The client polls on a 24 hour backup timer alongside a push channel, and its safety argument rests on client-side content-signature verification, described in Mozilla's documentation as throwing an error if local data was altered. That shape, a high-trust channel that every client pulls automatically, is what makes a protection-mechanism failure in its client code operationally interesting.
The same Firefox 154 advisory, which covers 58 CVEs in total, carries a second bug in the same component: CVE-2026-74942, a privilege escalation in the Remote Settings Client, also rated high. Two defects in one component in one release is worth noting for anyone tracking component risk, though Mozilla draws no connection between them.
On severity, Mozilla's published criteria put sec-high at "exploitable vulnerabilities which can lead to the widespread compromise of many users requiring no more than normal browsing actions", and reserve sec-critical for issues presenting "an ongoing or immediate danger to Firefox users". Mozilla chose high. A sandbox escape is also, by construction, usually half a chain: it breaks the boundary confining attacker-influenced content, but an attacker typically needs a content-process bug to get inside the sandbox first, and a separate local privilege escalation to reach SYSTEM or root. The CISA-ADP vector's PR:N/UI:N/S:C framing is not corroborated by any published mechanism.
Threat model
Who would exploit this: The most likely operators are state-aligned espionage teams, since a no-interaction sandbox escape in a mainstream browser and mail client is exactly the capability those programs buy or build, and Firefox and Thunderbird are heavily represented among journalists, NGOs, government Linux desktops and privacy-conscious targets. Second are targeted criminal operators, particularly initial-access brokers and ransomware affiliates who chain browser bugs to land a foothold and then sell or escalate it. Opportunistic mass exploitation is the least likely near-term category, because Firefox's desktop share makes it poor economics for drive-by kits.
What they're after:
- Initial foothold: code execution outside the content sandbox on a user endpoint
- Credential and session theft: saved passwords, cookies, SSO and OAuth tokens from the browser and mail profile
- Data exfiltration: local mail archives, downloads and documents the user account can read
- Persistence: user-level autostart, extension or profile tampering, token replay that survives reboot
- Lateral movement: reuse of stolen sessions, VPN certificates and the workstation's domain context
- Financial fraud: mailbox access supporting business email compromise, most relevant on Thunderbird
Attack chain: Because Mozilla published only the class and component, the trigger path is not publicly established. In operational terms the attacker needs attacker-influenced content in front of the target, typically a page the victim visits or a browser-like rendering context, and the flaw then breaks the boundary that is supposed to keep that content confined. Mozilla's Thunderbird advisory carries the standard note, sitting directly above this CVE, that these flaws generally cannot be exploited through email because scripting is disabled when reading mail, but remain risks in browser or browser-like contexts. Realistic Thunderbird exposure is therefore its content tabs, feeds and remote content rather than simply opening a message.
Blast radius: A compromised endpoint yields what the logged-in user holds: the browser profile with cookies, live SSO session tokens and saved passwords, plus the Thunderbird profile with cached mail, IMAP and SMTP credentials and stored OAuth refresh tokens, which together often reproduce access to mail, file shares and cloud consoles without a password prompt. Execution as the user also inherits the workstation's domain context and any authenticated VPN or cloud CLI sessions. It is not automatically administrator, SYSTEM or root: an application-privilege escape stops at the user's rights, and full host control requires a separate escalation.
No attribution exists for this CVE and none is asserted.
Mitigation
Patch
Upgrade to Firefox 154 or Thunderbird 154. Both shipped August 18, 2026, and the upgrade is the only remedy Mozilla publishes.
| Product |
Fixed version |
Advisory |
| Firefox |
154 |
MFSA 2026-74 |
| Thunderbird |
154 |
MFSA 2026-78 |
| Firefox ESR |
No fix published |
CVE not listed in MFSA 2026-75/76/77 |
| Thunderbird ESR |
No fix published |
CVE not listed in MFSA 2026-79/80 |
The realistic reason a managed fleet stays below 154 is policy, not patch availability. Audit for a pinned or disabled updater before assuming deployment coverage:
Get-Content 'C:\Program Files\Mozilla Firefox\distribution\policies.json' -ErrorAction SilentlyContinue
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Mozilla\Firefox' -ErrorAction SilentlyContinue
# macOS managed preferences
defaults read /Library/Preferences/org.mozilla.firefox 2>/dev/null
# policies.json shipped alongside the app
cat /Applications/Firefox.app/Contents/Resources/distribution/policies.json 2>/dev/null
cat /etc/firefox/policies/policies.json 2>/dev/null
An AppUpdatePin below 154 will silently hold hosts on a vulnerable build. Where update policy is the blocker, the relevant settings are:
{
"policies": {
"DisableAppUpdate": false,
"AppAutoUpdate": true,
"BackgroundAppUpdate": true
}
}
These are update-hygiene controls, not vendor mitigations for this CVE. Mozilla published no workaround.
Compensating controls
- Do not attempt to disable Remote Settings. It delivers the add-on and driver blocklists, certificate revocation and CRLite data. Redirecting
services.settings.server or suppressing synchronisation degrades other security controls and is not a mitigation. Mozilla does not recommend it and neither do we.
- Prioritise by user, not by asset value. If the espionage-oriented threat model applies to your organisation, the exposed population is journalists, legal, policy and executive staff, not the server estate.
- Reduce the payoff. Enforce hardware-backed or phishing-resistant MFA so stolen session cookies and OAuth refresh tokens have a shorter useful life, and shorten session lifetimes on high-value SaaS.
- Cut the chain's other half. A sandbox escape needs a content-process bug alongside it. Keeping the whole browser current, rather than patching this CVE alone, is what removes the pairing.
- Inventory beyond the managed installer. Per-user Windows installs, Snap, Flatpak and portable copies are the builds that survive a fleet-wide patch push.
Detection (starter rules, validate before deploying)
These rules are AI-generated starter content. Test against your own telemetry and tune falsepositives before deploying to production.
Set expectations first. No exploit exists in public, so there is nothing CVE-specific to signature. Everything below detects either the post-exploitation shape of a browser sandbox escape or tampering with the Remote Settings channel. Neither detects the vulnerability itself.
Network and log signals
- Remote Settings polling to a non-Mozilla host. Proxy, Zeek or TLS SNI logs showing a Firefox or Thunderbird user agent requesting the URL shape
/v1/buckets/<bucket>/collections/<collection>/changeset or .../records where the destination is not firefox.settings.services.mozilla.com, remote-settings.mozilla.org or prod.remote-settings.prod.webservices.mozgcp.net. Stage endpoints (firefox.settings.services.allizom.org) appearing on production hosts also warrant triage.
- Requests to the
security-state bucket (/v1/buckets/security-state/collections/intermediates/records or .../cert-revocations) from any non-Mozilla host. That bucket feeds certificate revocation and intermediate preloading, so an attacker-controlled copy is a TLS trust problem in its own right.
MOZ_REMOTE_SETTINGS_DEVTOOLS=1 in a browser process environment. On Release and Beta builds Firefox ignores a services.settings.server override unless this variable is set, so its presence via a modified shortcut, a wrapper script, a .desktop Exec line or a macOS plist is a prerequisite for a working redirect and a strong tamper signal on an end-user endpoint.- The
services.settings.server pref existing at all. It is not written to a profile by default. Hunt %APPDATA%\Mozilla\Firefox\Profiles\*\prefs.js and user.js, ~/.mozilla/firefox/*/, ~/.thunderbird/*/, and the macOS profile equivalents.
- AutoConfig hijack, the supported route to setting an arbitrary pref: creation or modification of a
.cfg in the install directory, defaults/pref/autoconfig.js, the general.config.filename pref, or autoadmin.global_config_url pointing at a remote URL. Writes into the install directory by anything other than the installer, updater.exe or maintenanceservice.exe should alert.
- Sync cadence anomalies.
services.settings.poll_interval lowered from its 24 hour default to seconds or minutes, or repeated changeset requests at high frequency from one host, indicates a profile retuned to pull attacker content quickly. Similarly services.settings.preview_enabled set true on a production endpoint, which expects legitimate hits only on QA machines.
- Writes to the Remote Settings local stores outside the normal daily poll: the profile IndexedDB database named
remote-settings and bucket-prefixed variants, the attachment cache under <profile>/settings/<bucket>/<collection>/, and the profile security_state directory. A write with no matching Mozilla-endpoint request is the anomaly.
- Browser processes behaving like implants:
firefox.exe or thunderbird.exe connecting to ports other than 443 and 80, reaching RFC1918 or cloud metadata addresses, opening a listening socket, or writing files outside the profile, cache and temp directories they own.
- Thunderbird spawning any interpreter or launching anything from a temp or attachment path. Thunderbird has no routine download-panel workflow that launches scripts, so its child-process baseline is far narrower than Firefox's and any deviation deserves higher severity.
- New persistence within minutes of a browser process event on the same host: Run and RunOnce values, Startup drops, scheduled tasks, WMI subscriptions,
~/.config/autostart/*.desktop, systemd user units, LaunchAgents. Join on host plus a short time window rather than alerting on either side alone.
YARA
rule MOZ_RemoteSettings_Server_Override_Config_Tampering
{
meta:
description = "Firefox/Thunderbird prefs.js, user.js or AutoConfig .cfg that points services.settings.server at a host Mozilla does not operate, or at plain HTTP. Config-tampering indicator, not an exploit artifact."
author = "CVE Brief (AI-generated starter rule, validate before deploying)"
date = "2026-08-19"
reference = "https://www.mozilla.org/en-US/security/advisories/mfsa2026-74/"
reference2 = "https://firefox-source-docs.mozilla.org/services/settings/index.html"
reference3 = "https://bugzilla.mozilla.org/show_bug.cgi?id=1598562"
cve = "CVE-2026-75874"
confidence = "medium"
note = "AI-generated starter rule, validate in your environment before deploying"
strings:
$pref = "services.settings.server" ascii nocase
/* Any assignment of the Remote Settings server pref.
user_pref() = prefs.js / user.js. pref(), defaultPref(), lockPref() = AutoConfig .cfg */
$set_any = /(user_pref|defaultPref|lockPref|pref)[ \t]*\([ \t]*["']services\.settings\.server["'][ \t]*,[ \t]*["']https?:\/\/[^"']{3,300}["']/ ascii nocase
/* Same assignment, but resolving to a Mozilla-operated endpoint. Negative condition. */
$set_moz = /(user_pref|defaultPref|lockPref|pref)[ \t]*\([ \t]*["']services\.settings\.server["'][ \t]*,[ \t]*["']https:\/\/([a-z0-9-]+\.)*(mozilla\.com|mozilla\.org|allizom\.org|mozgcp\.net|mozaws\.net)(:[0-9]{1,5})?\// ascii nocase
/* Plain HTTP for this pref is anomalous regardless of host */
$set_plain_http = /(user_pref|defaultPref|lockPref|pref)[ \t]*\([ \t]*["']services\.settings\.server["'][ \t]*,[ \t]*["']http:\/\// ascii nocase
condition:
filesize < 4MB
and $pref
and ( ( $set_any and not $set_moz ) or $set_plain_http )
}
Sigma
title: Firefox or Thunderbird Spawning Shell or LOLBin Child Process
id: 3f8c1d24-6b7a-4e59-9a02-c7d15be4f8a1
status: experimental
description: |
Detects firefox.exe or thunderbird.exe spawning a command interpreter or a signed
living-off-the-land binary. Mozilla content processes are sandboxed and normally
only spawn a small, fixed set of Mozilla helper executables, so an interpreter or
LOLBin child is a strong post-exploitation indicator for any browser sandbox escape,
including CVE-2026-75874 (sandbox escape in the Remote Settings Client component,
fixed in Firefox and Thunderbird 154, MFSA2026-74). The rule is behavioural and is
not specific to any published exploit for this CVE; it will fire on any successful
escape-to-execution regardless of the underlying bug.
author: CVE Brief (AI-generated starter rule, validate before deploying)
date: "2026-08-19"
references:
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-74/
- https://firefox-source-docs.mozilla.org/services/settings/index.html
tags:
- attack.execution
- attack.t1059
- attack.defense-evasion
- attack.t1218
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\firefox.exe'
- '\thunderbird.exe'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\rundll32.exe'
- '\regsvr32.exe'
- '\bitsadmin.exe'
- '\certutil.exe'
- '\msiexec.exe'
- '\installutil.exe'
- '\schtasks.exe'
- '\curl.exe'
# Explicit allowlist of Mozilla helper binaries that legitimately run as children
# of firefox.exe / thunderbird.exe. Redundant against the child list above, but kept
# so analysts who broaden selection_child do not drown in updater and crash-reporter noise.
filter_main_mozilla_helpers:
Image|endswith:
- '\plugin-container.exe'
- '\crashreporter.exe'
- '\minidump-analyzer.exe'
- '\updater.exe'
- '\maintenanceservice.exe'
- '\pingsender.exe'
- '\default-browser-agent.exe'
- '\firefox.exe'
- '\thunderbird.exe'
condition: selection_parent and selection_child and not 1 of filter_main_*
fields:
- ParentImage
- ParentCommandLine
- Image
- CommandLine
- User
- ProcessId
falsepositives:
- Firefox or Thunderbird self-update and crash handling spawning Mozilla helper
binaries such as updater.exe, maintenanceservice.exe, crashreporter.exe or pingsender.exe
- A user deliberately opening a downloaded script, installer or shortcut from the
browser download panel, which launches the associated interpreter as a browser child
- Protocol handler or "open with" associations that map a URI scheme or MIME type to
an interpreter, including custom enterprise handlers and mailto integrations
- Native messaging hosts registered by browser extensions that are wrapped in a .bat
or .ps1 launcher, a very common benign source of powershell.exe under firefox.exe
- Managed browser tooling, software deployment agents and helpdesk scripts that are
intentionally launched from the browser
- Selenium, Playwright or other QA automation driving Firefox in test and build estates
level: high
Rule notes
The Sigma rule is post-exploitation behaviour, not CVE-specific: it fires when a sandboxed Mozilla process spawns an interpreter or LOLBin, which is what a successful escape looks like regardless of which bug was used. It will therefore catch unrelated escapes and will miss an in-process implant that never spawns a child. The native-messaging false positive is the one that matters in practice, since extension launchers wrapped in .bat or .ps1 are a common benign source of powershell.exe under firefox.exe. Baseline before enabling.
The YARA rule flags a redirected Remote Settings client, not the vulnerability. One structural limitation: a file containing both a benign and a malicious assignment of the same pref will match $set_moz and suppress the alert. Note also that Firefox enterprise policy cannot set this pref, because policies.json only accepts an allowlisted set of prefixes and services. is not among them, so prefs.js, user.js and AutoConfig .cfg are the files worth scanning.
One data-quality note for anyone reconciling scanner output: Debian's security tracker showed src:firefox at 154.0-1 marked vulnerable with fixed version "(unfixed)" on August 19, which contradicts Mozilla's own statement that 154 is the fix. That is almost certainly automated import lag rather than a Debian-specific exposure.
References