Mozilla Products Multiple Vulnerabilities

CSIRTS triage

What

Multiple unspecified vulnerabilities in Mozilla products.

Who is affected

Users of Mozilla Firefox, Thunderbird, and related products.

Urgency

Severity and exploitation status unknown; apply patches when available.

Action

Check Mozilla security advisories and update affected products to the latest version.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

HKCERT Security Bulletins (HK · national-cert · site)

Severity

unknown

Published

2026-08-19

Exploitation

Not in CISA KEV at last sync

Original advisory: https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities_20260819

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-749340.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-749350.32% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 25% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-749360.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 5% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-749370.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-749380.32% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 24% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-749390.32% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 25% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-749400.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-749410.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 28% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-749420.32% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 25% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-749430.20% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 10% of all EPSS-scored CVEs.

Referenced CVEs

+10 more CVEs referenced in this advisory.

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• high[NEW] [high] Mozilla Firefox, Firefox ESR and Thunderbird: Multiple Vulnerabilitiescert-bund
• unknownDSA-6451-1 firefox-esr - security updatedebian
• unknownMultiple vulnerabilities in Mozilla products (August 19, 2026)cert-fr-avis
• criticalCVE-2026-75874: Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefo…nvd
• criticalCVE-2026-74990: Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird…nvd
• unknownCVE-2026-74989: Internally found bugs present in Thunderbird 153. Some of these bugs showed evidence of memory…nvd
• unknownCVE-2026-74988: Internally found bugs present in Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs…nvd
• criticalCVE-2026-74987: Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird…nvd
• unknownCVE-2026-74986: Site isolation issue in the CSS Parsing and Computation component. This vulnerability was fixe…nvd
• unknownCVE-2026-74985: Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Fir…nvd
• unknownCVE-2026-74984: Race condition in the JavaScript Engine component. This vulnerability was fixed in Firefox 154…nvd
• highCVE-2026-74983: Mitigation bypass in the Data Loss Prevention component. This vulnerability was fixed in Firef…nvd

More from HKCERT Security Bulletins

• unknownOracle Products Multiple Vulnerabilities2026-08-19
• unknownGitLab Multiple Vulnerabilities2026-08-19
• unknownGoogle Chrome Multiple Vulnerabilities2026-08-19
• unknownApple Products Multiple Vulnerabilities2026-08-18
• unknownMicrosoft Edge Multiple Vulnerabilities2026-08-17