Firefox and Thunderbird DOM Use-After-Free (CVE-2026-74944)

Technical Analysis

CVE-2026-74944 is a use-after-free vulnerability residing in the DOM: Core & HTML rendering component of Mozilla Firefox and Thunderbird, likely triggered when a DOM object is freed while still referenced by active script execution, enabling memory corruption and potential arbitrary code execution. Exploitation typically requires a victim to visit a malicious or compromised webpage (or open a crafted email in Thunderbird), where attacker-controlled JavaScript manipulates object lifecycle to achieve a stale pointer dereference. Given the CVSS 9.8 score, this suggests low attack complexity, no privileges required, and potential for full system compromise without user interaction beyond page load. Organizations running AI agent systems that use Firefox-based headless browsers, Selenium/Playwright automation with bundled Firefox engines, or Thunderbird-based email processing pipelines for agent workflows are directly exposed, as a malicious webpage or email rendered by an agent's browsing/email tool could trigger remote code execution on the host running the agent, potentially exposing API keys, credentials, and connected tool integrations.

Affected Systems

Firefox versions prior to 154; Firefox ESR versions prior to 140.14 and 153.1; Thunderbird versions prior to 154; Thunderbird ESR versions prior to 140.14 and 153.1

Indicators of Compromise

• No specific IOCs published; vulnerability is client-side and triggered via malicious web content or email rather than known malware artifacts

Remediation Steps

1. 1

   Update Firefox

   Upgrade all Firefox installations to version 154 or later, or apply ESR updates 140.14/153.1 depending on the release channel in use.

2. 2

   Update Thunderbird

   Upgrade Thunderbird to version 154, 140.14, or 153.1 to remediate the vulnerability.

3. 3

   Patch automation and agent tooling

   Audit any AI agent, RPA, or automation pipelines that bundle or invoke Firefox/Gecko-based browsers (e.g., via Selenium, Playwright, or headless browser tools) and update the underlying browser engine to a patched version.

4. 4

   Restrict untrusted content rendering

   For agent systems that browse or process untrusted web pages/emails, implement sandboxing, network egress restrictions, and disable unnecessary JavaScript execution where feasible until patches are applied.

5. 5

   Rotate exposed credentials

   If exploitation is suspected on hosts running agents with access to API keys or credentials, rotate all secrets accessible from the affected host.